A flaw exists in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools that permits a low-privileged user who can reach the system over HTTP to gain unauthorized access to critical or all data exposed through PeopleSoft. The vulnerability is an insecure permission assignment flaw, resulting in a confidentiality impact and a CVSS 3.1 base score of 6.5.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically versions 8.61 through 8.63, are affected. The flaw lies within the Report Distribution feature used to disseminate data to end users, and the affected instances are exposed to HTTP traffic.

The CVSS score indicates a moderate risk, and the EPSS score suggests a very low probability of exploitation. Because the attack vector is network-based and requires only a low privilege level, the vulnerability can be exploited from any publicly reachable machine. It is not listed in the CISA KEV catalog, indicating it has not yet been widely abused, but administrators should treat it as a potential exposure and act promptly.