The vulnerability resides in the Portal component of Oracle PeopleSoft Enterprise PeopleTools. It allows an attacker with limited local privileges and network access through HTTP to read sensitive data, and potentially gain full read access to all data exposed by the application. Attackers can also trigger a partial denial of service by causing the application to become unresponsive to legitimate requests, affecting availability. The weakness stems from insufficient validation of privilege level before processing data requests, resulting in confidentiality and availability impacts.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically Portal, is vulnerable in versions 8.61 through 8.63. No additional versions are currently listed as affected.

The CVSS 3.1 base score of 7.1 indicates a moderate to high severity, with notable confidentiality loss and mild availability compromise. Although the EPSS score is not available, the description confirms the vulnerability is easily exploitable for low‑privilege attackers with network access. Because the vulnerability is not included in the CISA KEV catalog, there is no confirmed exploitation evidence yet, but the ease of exploitation and the potential for data breach make it a high priority for remediation.