Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Apache OFBiz allows unauthenticated users to execute screen rendering code on certain endpoints when permission checks are not explicitly enforced. This could let attackers bypass security controls and access or manipulate sensitive functionality without logging in.

CWE-863 (Incorrect Authorization) vulnerability in Apache OFBiz ≤18.12.14 permits unauthenticated access to screen rendering endpoints when screen definitions lack explicit permission validation. Attack vector requires network access to affected endpoints; exploitation occurs when screens rely solely on endpoint configuration for authorization rather than inline checks. Impact includes unauthorized code execution and potential data exposure or system compromise.