A vulnerability in Oracle REST Data Services allows an attacker who has high privileges and network access over HTTP to modify data stored in the service. The flaw can lead to unauthorized update, insert or delete operations against accessible data, thus compromising the integrity of the data stored by the service. The CVE description indicates that the attacker must have high privileges and the attack requires user interaction from a person other than the attacker, limiting the immediacy of exploitation but still enabling data tampering if the conditions are met. The underlying issue is improper access control (CWE-284).

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The vulnerability is located in the Core component of the software and applies to all deployments of these versions that expose HTTP endpoints for data manipulation.

The CVSS score of 2.4 reflects a low severity impact focused solely on integrity. The EPSS score of 0.00252 indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploitable public tools or widespread attacks. Because the attack requires high‑privileged credentials and human interaction from a non‑attacker, the practical risk is moderate to low, but the potential for data loss remains if an insider or socially engineered user grants the necessary access.