Oracle REST Data Services suffers from an authorization flaw in its Database Actions component, enabling an attacker with sufficient privileges to update, insert, delete, or read protected data. The weakness also permits the attacker to generate a partial denial of service, disrupting service availability. The vulnerability impacts confidentiality, integrity, and availability with a low-level effect on each, providing significant risk to organizations that rely on the data exposed through the service.

The flaw exists in Oracle REST Data Services versions 24.2.0 through 26.1.0. Users running any of these releases and exposing the service over HTTP are vulnerable. Systems using newer or older versions are not noted as affected in the current advisory.

The CVSS 3.1 score of 4.7 indicates a moderate severity rating, with the vector indicating that network access, low attack complexity, high privileges, no user interaction, and unspecified scope are required. The advisory does not list the vulnerability in CISA’s KEV catalog and the EPSS score is present and <1%, indicating a very low likely exploitation probability. Nevertheless, the nature of the flaw means that anyone with a high level of authorization and network access to the service can exploit this local-privilege issue to affect data integrity or availability.