The vulnerability in Oracle REST Data Services allows an unauthenticated attacker who can reach the service over HTTP to potentially alter or delete data stored by the service, as well as read a subset of that data. This flaw is rated with a CVSS 3.1 base score of 5.4, indicating moderate confidentiality and integrity impact. The exploit requires direct network access to the REST endpoint and some human interaction on behalf of a third party, but once it is triggered it can lead to unauthorized updates, inserts, or deletes of data and partial data leaks.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The flaw resides in the Backend‑as‑a‑Service component of the product.

With a CVSS score of 5.4, the exploitation risk is moderate. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that widespread, automated exploitation has not been observed. Attackers would need network connectivity to the REST endpoint and may need to engage a user to complete the exploit sequence, but the availability of the flaw without authentication remains a concern for environments that expose the service to untrusted networks.