A vulnerability in the GraphQL component of Oracle REST Data Services permits an unauthenticated attacker who can reach the service over HTTP to trigger unauthorized read access to a subset of data exposed by the service. The flaw allows the attacker to retrieve hidden or sensitive information, impacting confidentiality but not integrity or availability. The weakness manifests as a failure to enforce proper access controls during GraphQL query processing, enabling the attacker to bypass authentication checks. The CVSS vector indicates a low attack complexity and no need for user interaction, underscoring that the exploit is easy to launch.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The vulnerability is specific to the GraphQL feature within the product; other components of Oracle REST Data Services are not impacted.

The CVSS base score of 5.3 places this issue in the medium severity range, reflecting the limited impact on confidentiality only. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting no publicly known exploitation at the time of analysis. Attackers would need network access to the machine hosting REST Data Services and would exploit the exposed GraphQL endpoint over HTTP. Because the attack does not require elevated privileges or advanced techniques, the overall risk is moderate, but timely remediation is recommended to mitigate potential data exposure.