An incorrect authorization check in Apache OFBiz’s updateLayout method can allow an attacker who is only authenticated and holds minimal CONTENTMGR_VIEW and OFBTOOLS_VIEW roles to execute arbitrary operating‑system commands. The flaw occurs because the method validates only a fixed CONTENT_CREATE operation rather than verifying update permission on the specific Content record being relinked. This vulnerability represents CWE‑863: Authorization Bypass Through User-Controlled Key.

Apache Software Foundation’s Apache OFBiz 24.09 releases prior to 24.09.08 on any supported platform are affected. The issue exists in the applications/content/minilang/layout/LayoutEvents.xml updateLayout simple‑method and applies to all installations that enable the Content Manager feature.

While specific CVSS, EPSS, and KEV metrics are not available, the vulnerability permits remote code execution under a non‑privileged authenticated context. The attack vector is inferred to be remote, authenticated, and requires the attacker to invoke the updateLayout action via the web UI or API. Once the authorization check is bypassed, the attacker can redirect a Content record to a malicious DataResource that points to the OFBiz access log, which is then evaluated by the showContent route, allowing arbitrary command execution on the process user’s account.