A vulnerability exists in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools that allows a low‑privileged attacker who can reach the system over HTTP to gain unauthorized access to critical data or the entirety of data accessible through PeopleSoft. This flaw is a classic improper access control weakness, resulting in a confidentiality impact and a CVSS 3.1 base score of 6.5.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically versions 8.61 through 8.63, which are exposed to HTTP traffic. The issue affects the Report Distribution functionality used to disseminate data to end users.

The CVSS score indicates a moderate risk and the problem is exploitable from the network without the need for elevated privileges. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited in the wild. Nonetheless, because the attack vector is network‑based and requires only low privileges, administrators should treat it as a potentially serious exposure.