Vulnerability exists in the ADP component of Oracle REST Data Services. A low‑privileged attacker with network access over HTTP can send crafted requests that result in unauthorized update, insert, or delete operations on data exposed by the service. The flaw permits integrity compromise of the affected data without affecting confidentiality or availability. The weakness is an instance of improper authorization (CWE‑284).

Oracle REST Data Services versions 24.2.0 through 26.1.0 installed by Oracle Corporation are affected. Any deployment that has exposed the ADP endpoint to a network requiring only low‑level authentication is vulnerable.

The CVSS v3.1 score of 4.3 reflects a moderate risk, with the attack vector being network (access via HTTP). The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not in CISA’s KEV catalog, suggesting limited known exploitation. Nevertheless, a low‑privileged attacker on the same network can readily exploit the flaw by sending HTTP requests to the vulnerable endpoint, achieving unauthorized data modification and compromising data integrity.