Oracle REST Data Services exposes a Backend‑as‑a‑Service component that can be accessed over HTTP. An unauthenticated attacker who can reach the service from the network may exploit a logic flaw that permits the attacker to perform update, insert or delete operations, as well as read a subset of the data. The vulnerability does not require privileged credentials but does require a human interaction from a third party, such as a user‑initiated action. The impact is loss of confidentiality and integrity for the affected data, with the potential to affect additional Oracle products when the scope changes.

The vulnerability is present in Oracle REST Data Services versions 24.2.0 through 26.1.0. The affected product is Oracle REST Data Services, specifically the Backend‑as‑a‑Service module. No other vendors or product versions are listed.

The CVSS v3.1 base score of 6.1 indicates a moderate severity. The EPSS score of 0.00238 (0.238%) indicates a very low probability that the vulnerability will be exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network‑based HTTP access with no authentication. An attacker would need to send crafted HTTP requests to the vulnerable endpoints, but would also need a separate human user to trigger the action, which reduces the ease of exploitation. Overall, the risk is moderate and warrants prompt remediation.