The vulnerability in Oracle REST Data Services permits low‑privileged attackers that can reach the service over HTTP to perform unauthorized updates, inserts, or deletes on data that should be protected, as well as read restricted subsets of data. The weakness is an improper access control flaw that allows privilege usage beyond the intended scope, affecting confidentiality and integrity of the stored information.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The flaw is present in the Core component of the product. No specific custom builds or OEM variants are listed; the impact applies to any deployment of these versions that exposes the REST API to a network.

The CVSS 3.1 base score is 4.2, indicating moderate risk. The vulnerability requires remote network access and low privileges but has no user interaction or authentication escalation, so exploitation is limited to entities with network reach to the REST endpoint. EPSS information is not available, and the issue is not yet listed in KEV, suggesting there is no confirmed exploitation but the potential remains for an attacker who can contact the exposed interface. Organizations should evaluate whether these versions are exposed and implement mitigations promptly.