A flaw in the Core component of Oracle REST Data Services permits an attacker with HTTP network access to gather a limited set of data without authentication, though the attacker must also rely on a human user to perform an action such as visiting a link or responding to a request. This weakness allows confidential information to be read, mapping to the CWE‑200 class of information exposure.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The vulnerability is present in all installations of the product supplied by Oracle Corporation within that version range.

The CVSS base score is 3.1, indicating a low severity impact that only touches confidentiality. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires network access over HTTP and a successful user interaction beyond the attacker’s direct control, the likelihood of widespread automated exploitation is limited, though the impact remains to expose sensitive data.