Oracle REST Data Services is vulnerable to a weakness that allows a high privileged attacker with network access via HTTP to gain unauthorized update, insert, or delete permissions on data exposed by the service, as well as read access to a subset of that data. The impact includes modification and disclosure of confidential information, with the CVSS vector indicating low confidentiality and integrity impacts. Successful exploitation requires human interaction from a person other than the attacker, meaning the vulnerability is difficult to exploit in an automated fashion.

Vendors impacted are Oracle Corporation with its Oracle REST Data Services product. The affected releases are versions 24.2.0 through 26.1.0 inclusive. These versions contain the Core component that is susceptible to the described weakness.

The CVSS score of 3.1 indicates low severity, with no EPSS score available and the vulnerability not listed in the CISA KEV catalog. Because the attack requires human interaction and an attacker with high privileges, the likelihood of successful exploitation in the wild is low, but the potential for data compromise still exists. The attack vector is likely over HTTP, requiring the attacker to leverage or coerce an authorized individual to perform an action that triggers the vulnerability.