The vulnerability is an improper authorization flaw in the ContentWorker component of Apache OFBiz, opening up a path for unauthenticated remote users to execute any OFBiz service that they specify in a Content entity's serviceName field. The attacker can pass arbitrary parameters through the HTTP request, and the service is invoked without an allow‑list, ownership verification, or authentication. Because the service can perform file operations, this allows arbitrary file writes, deletions, and can be abused for server‑side request forgery. The weakness is classified as CWE‑470.

Apache OFBiz releases 24.09 prior to version 24.09.08 on all supported platforms are affected. The product vendor is the Apache Software Foundation and all installations of the 24.09 release that have not applied the 24.09.08 update are vulnerable.

The flaw is publicly exposed through the showHelpPublic view and requires no authentication, meaning any unauthenticated HTTP client can trigger it. No EPSS score is available, yet the absence of authentication together with the ability to perform privileged file and network operations results in a high likelihood of exploitation by a motivated adversary. The vulnerability is not currently listed in CISA KEV, but the potential impact is severe.