A flaw in Apache OFBiz 24.09 before 24.09.08 lets a remote attacker access hidden helper endpoints in the Human Resources, Catalog, and Order Manager modules without authentication. The code paths return sensitive internal records – including company data, employee details, product catalog information, and store inventories – after performing no permission checks, exposing confidential business information.

Apache Software Foundation’s Apache OFBiz releases 24.09 and earlier, up to but not including 24.09.08, are affected on all supported operating systems. The vulnerability exists across the HR, Catalog, and Order Manager applications on these versions.

The vulnerability can be exploited over the network by constructing simple HTTP requests to the exposed helper URLs, requiring no credentials or elevated privileges. While the EPSS score is currently unavailable and the issue is not listed in the CISA KEV catalog, the lack of authentication combined with the breadth of data available suggests a high confidentiality risk. Given the straightforward request pattern and the potential for mass data extraction, the risk is considered high for organizations still running the vulnerable releases.