Oracle REST Data Services contains an HTTP-based vulnerability that can be exploited by a low‑privilege attacker. The flaw permits unauthorized update, insert, or delete operations and the reading of certain data, leading to confidentiality and integrity violations. The CVSS v3.1 vector lists a medium severity base score of 5.4 with low attack complexity, low required privileges, user interaction, and a scope change. The impact is limited to data accessed through the REST interface.

The affected product is Oracle REST Data Services, specifically versions 24.2.0 through 26.1.0. Both the vendor name and product are listed by the CNA, and no other impacted versions are disclosed.

Exploitation requires network access via HTTP and a low‑privileged attacker, but also needs human interaction from another user to initiate the attack. The attack can occur remotely if the REST interface is exposed to untrusted networks, and a scope change indicates that adjacent components may also be affected. The EPSS score is less than 1% indicating very low predicted exploit probability. The vulnerability is not listed in the CISA KEV catalog, and the CVSS score of 5.4 signals medium severity. Combined, the likelihood of exploitation is low, though the potential for unauthorized data modification and read remains if the conditions are met.