An unauthenticated attacker targeting the Siebel Apps - Marketing component via an HTTP interface can cause unauthorized update, insert, or delete operations on marketing data. The flaw does not allow disclosure or service disruption, but it permits integrity compromise for data accessible through the marketing module. The vulnerability is rooted in a broken access control weakness, inferred as CWE-284.

The issue impacts Oracle Siebel Apps - Marketing across supported versions 17.0 through 26.9. These versions expose a public HTTP endpoint that can be accessed without authentication. Only these iterations are affected; newer versions beyond 26.9 are not listed as vulnerable.

The base CVSS score of 4.3 places the vulnerability in the moderate range, with the vector indicating network access, low complexity, no privilege, and the need for user interaction from someone other than the attacker. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation is not known. An attacker would need to lure a legitimate user into executing a crafted HTTP request, after which the system would apply write operations to marketing data.