Oracle REST Data Services has a vulnerability in the Database Actions component that allows an attacker with high privileged network access via HTTP to perform unauthorized updates, inserts, and deletes, as well as read restricted data. This weakness is an instance of CWE‑284 (Improper Access Control) and is reflected in a CVSS 3.1 base score of 4.7, indicating moderate confidentiality, integrity, and availability impact. The potential outcome is a compromise of sensitive data and limited service disruption for the affected REST endpoints.

Affected systems are Oracle REST Data Services versions 24.2.0 through 26.1.0 provided by Oracle Corporation. These releases contain the vulnerable Database Actions component identified by the Oracle vendor.

The attack vector is a network-based HTTP request that a high privileged attacker can launch. With a CVSS score of 4.7, the vulnerability carries moderate risk, yet its easy exploitability makes it a serious target for malicious actors. The EPSS score is 0.00291, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, but the lack of proper access control still warrants prompt remediation. Successful exploitation could lead to data tampering and partial denial of service in the REST service.