CVE-2024-38856

The flaw is an incorrect authorization issue in Apache OFBiz through 18.12.14. Certain endpoints that should be unauthenticated do not properly enforce permission checks before rendering screens, and where screen definitions rely on the endpoint's configuration rather than checking the user's permissions themselves, an unauthenticated attacker can invoke screen-rendering logic they should not reach. Chained appropriately, that exposure lets an attacker drive the application into executing code, so the practical impact is remote code execution against a default-configured instance.

OFBiz is an open-source ERP and e-commerce framework that underpins order management, accounting, and customer data, so a compromised instance exposes sensitive business records and can serve as a pivot into the surrounding environment. This CVE stems from an authorization-bypass pattern that has been repeatedly probed in OFBiz, and public exploit code circulated after disclosure, so internet-facing deployments should be treated as targeted. Upgrade to 18.12.15 or later, keep the application behind access controls rather than openly exposed, and review the host for unexpected process execution and the application logs for anomalous requests to control and view endpoints.