Apache OFBiz’s ContentPermissionServices contains an incorrect authorization check. An authenticated attacker who has only a content‑create privilege can invoke the createContentRole service (for example, via a createForumGroupRole request) and cause the system to fall through a fail‑open default‑grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose. This allows the attacker to self‑grant the OWNER role on arbitrary content. With that role, the attacker bypasses ownership checks and can update, delete, or change the status of the content, giving them full read, write and delete control over material they should not possess. The flaw is a classic authorization bug (CWE-862).

All installations of Apache OFBiz up to, but not including, version 24.09.08, regardless of operating platform, are affected. The vulnerability exists in the ContentPermissionServices component across all supported platforms.

The vulnerability is exploitable by any authenticated user who has been granted content‑create rights, which are commonly assigned to many users. Because the exploit does not require any special environment or additional network level access, the risk is significant, though the exact likelihood cannot be quantified due to the unavailability of an EPSS score and the absence of a KEV listing. Nevertheless, the potential for an attacker to obtain OWNER privileges on arbitrary content represents a high‑severity privilege escalation problem. Affected deployments should apply the vendor’s patch promptly to eliminate the flaw.