The vulnerability lies in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools. A low‑privileged attacker who can send HTTP requests to the exposed endpoint can read a subset of the application data that should normally be protected by PeopleSoft’s access controls. This results in a confidentiality breach that does not affect integrity or availability. The weakness is an authorization flaw (CWE‑863).

Oracle PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are affected. The flaw is specific to the Report Distribution feature of the PeopleTools product and requires that the component be accessible over HTTP.

The CVSS 3.1 base score of 4.3 places the issue in the moderate severity band. Exploitation requires a low‑privileged user on the network, with low attack complexity and no special privileges. The EPSS score of less than 1% indicates that active exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers need only the ability to reach the HTTP service that hosts the Report Distribution endpoint; no additional privileges or social engineering are required.