Oracle REST Data Services contains an access‑control flaw that lets a low‑privilege user, who can reach the service over HTTP, update, insert, delete, or read data that the service exposes. The weakness permits an attacker to compromise the confidentiality and integrity of the data handled by the REST service, without affecting availability.

The affected package is Oracle REST Data Services version 24.2.0 through 26.1.0. The vulnerability is present in the Core component of the product, which is used by organizations to expose database tables over HTTP.

The CVSS 3.1 base score of 4.2 indicates low severity; the exploit likelihood is unclear as no EPSS score is available. The vulnerability is not listed in CISA’s KEV catalog. A network attacker with HTTP access can exploit the flaw, but the requirement for low privileges limits the attack surface and incentives. Since the vulnerability cannot cause denial of service, the primary concern is unauthorized data tampering and disclosure.