This vulnerability exists in the ADP component of Oracle REST Data Services and allows an attacker to read protected data without authentication. The flaw does not provide code execution or system compromise; it specifically enables unauthorized read of a subset of data exposed by the service. The weakness directly impacts confidentiality, as indicated by the CVSS vector that marks Confidentiality as Low and no impact on Integrity or Availability.

The flaw affects Oracle REST Data Services versions 24.2.0 through 26.1.0. Users deploying these affected releases are at risk if the service is reachable over the network.

The CVSS v3.1 Base Score of 5.3 indicates moderate severity. The EPSS score of 0.316% indicates a very low exploitation probability, yet the vulnerability is classified as 'Easily exploitable' and is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. An attacker would need only network connectivity to the HTTP interface of REST Data Services; no additional credentials or privileges are required. The attack is inferred to be carried out over the network, as the description explicitly mentions HTTP access.