Apache OFBiz versions prior to 24.09.08 allow an authenticated attacker who only has a low‑privilege account in one tenant to read or modify data belonging to another tenant. The vulnerability arises because the framework resolves the tenant from the hostname but then uses a supplied userTenantId parameter for authentication, effectively bypassing the tenant isolation layer. This enables unauthorized confidentiality and integrity violations without needing elevated privileges, representing a classic authorization bypass weakness (CWE‑863).

The issue affects all platforms running Apache OFBiz 24.09 before 24.09.08 when the documented multitenancy feature is enabled. The product is released by the Apache Software Foundation.

No public CVSS score or EPSS value is listed, and the vulnerability is not in the CISA KEV catalog, so the precise exploitation probability is unknown. However, the attack requires only a valid low‑privilege user account and normal remote access to the login endpoint. The attacker can supply their own tenant identifier and credentials, causing the system to authenticate against the attacker’s tenant while subsequent operations are performed against the hostname‑mapped tenant’s data store. Because the logic flaw occurs during login, it is likely exploitable with standard web requests and does not demand specialized tools, making it a practical threat to affected installations.