This vulnerability in Oracle Capacity allows an attacker with low privileges to exploit the service over HTTP and obtain unauthorized access to data, including the ability to insert, update, or delete records. The impact is a combination of confidentiality and integrity compromise, along with the potential to cause a partial, non‑global denial of service. The flaw resides in insufficient access control, as indicated by the stated privileges and attack vector.

Oracle Capacity versions 12.2.3 through 12.2.15 are affected. The issue is confined to the Internal Operations component of Oracle E‑Business Suite and applies to all installations of these version ranges.

The CVSS v3.1 base score of 7.6 denotes high severity for confidentiality, integrity and availability impacts. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network‑based via HTTP and requires only low‑privileged user credentials or none at all, making the exploitation of this flaw relatively simple for an automated attacker.