A vulnerability in Oracle REST Data Services allows a low privileged attacker with network access to perform unauthorized insert, update, delete, and read operations on data exposed by the service. Based on the description, it is inferred that the weakness is due to insufficient access control checks, resulting in both confidentiality and integrity impacts when the attacker successfully exploits the flaw.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The vulnerability is present in the Core component of these releases.

The CVSS base score of 5.4 indicates moderate severity, with a network attack vector and low-privilege requirement. No EPSS score is available and the issue is not in the CISA KEV catalog. Based on the description, it is inferred that the likely attack path involves an HTTP request sent from an external or untrusted network that bypasses proper authorization, allowing the attacker to modify or retrieve data that should otherwise be protected.