Missing authorization in Apache OFBiz 24.09 prior to 24.09.08 allows a remote authenticated attacker who holds only catalog view permission to trigger bulk mutation events on search results. The ProductSearchEvents module authorizes requests solely against the base view-level permission, while the underlying event methods perform entity-engine deletes and inserts without checking the required DELETE/CREATE permissions. This flaw, identified as CWE‑862, lets an attacker modify product–category and product–feature associations across arbitrary search results, thereby corrupting catalog data.

All installations of Apache OFBiz 24.09 released before 24.09.08 on any supported platform are vulnerable. The issue exists in the default distribution and can be exploited by any user who can seed a broad product search, regardless of the target catalog.

An attacker needs only catalog view rights and no special software to exploit the flaw. No EPSS score is publicly available and the vulnerability is not listed in CISA’s KEV catalog. The exploit does not provide remote code execution; however it directly undermines data integrity and can have significant business impact by misrepresenting product information.