Missing authorization in the ProductEvents component of Apache OFBiz 24.09 allows an authenticated user with only catalog view permission to invoke catalog quick‑admin events and perform arbitrary create, modify or delete operations on product, product feature association, and product category association data. The underlying event methods execute entity‑engine writes without validating the higher‑level catalog update/create permission, effectively bypassing the intended access controls and exposing the system to unauthorized data manipulation. This weakness corresponds to CWE‑862: Missing Authorization.

Apache OFBiz distributed by the Apache Software Foundation. All platform implementations of version 24.09 prior to the 24.09.08 release are affected. Users should verify that the version in use is earlier than 24.09.08.

The vulnerability requires remote authenticated access but only a minimal catalog view permission, a privilege commonly granted to many users. EPSS data is not available and the vulnerability is not listed in CISA KEV, but the absence of authorization checks is a severe flaw that can be exploited to subvert catalog integrity. The exploit path is straightforward: the attacker directly calls the catalog quick‑admin event URLs, causing the servlet to authorize against the base view level permission while bypassing the stricter update checks. The resulting impact is a loss of data integrity and potential disruption of e‑commerce operations.