An improperly authorized administrator method is present in the ADP component of Oracle REST Data Services which enables a low‑privileged attacker who can reach the service over HTTP to modify, delete, or insert data and to read data that should be protected. The vulnerability is exploitable through standard HTTP requests and does not require authentication beyond local network access. The damage manifests as unauthorized changes and exposure of confidential information, affecting both the confidentiality and integrity of the data handled by the application, but the availability remains unaffected.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are vulnerable. The exposure is limited to the REST data service component and does not affect other Oracle products.

The CVSS v3.1 base score of 5.4 indicates a moderate severity attack. No EPSS score is provided, suggesting limited or unknown exploitation probability at the current time. The vulnerability is not listed in the CISA KEV catalog, but the low privileged attacker requirement combined with network‑level access could still allow attackers to compromise the service. The likely exploit path involves sending crafted HTTP requests to the ADP endpoint from an internal or exposed network position.