Oracle REST Data Services is vulnerable to an information‑disclosure and data‑tampering flaw in its Database Actions component. An attacker who can send HTTP requests to a target instance and who has only low privilege is able to trigger the flaw, which requires a second person’s interaction to complete. Successful exploitation allows the attacker to update, insert or delete data that should be protected, as well as read a subset of the data accessible through the REST API. The weakness is related to insufficient access control, leading to both integrity and confidentiality impact.

Oracle Corporation’s Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The flaw may also influence other integrated Oracle products because the vulnerability’s scope is labelled as changing across products.

The CVSS v3.1 base score of 5.4 indicates moderate severity, with low complexity and low privilege required for exploitation but a user‑interaction prerequisite. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits yet. However, the need for network access via HTTP and the possibility of impacting other products raise the overall risk for environments that expose REST endpoints without proper safeguards.