This flaw in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools enables an attacker with no authentication to read any data exposed over the HTTP interface. The vulnerability is caused by an access control oversight that permits unauthenticated HTTP requests to retrieve reports or data. When exploited, an attacker gains confidential information from the PeopleSoft database, compromising confidentiality but with no impact on integrity or availability. The flaw’s CVSS 3.1 base score of 7.5 reflects the high confidentiality impact.

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are impacted. The issue resides in the Report Distribution component, which is present in all affected releases. No other products or vendors are listed as vulnerable by the CNA.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N shows that the attack requires only network access over HTTP and no privileges. The EPSS score of < 1% indicates a low probability of exploitation, but the absence of an authentication requirement means any actor with network reachability can exploit it. The flaw is not listed in the CISA KEV catalog, yet the straightforward exploit path warrants immediate attention.