A flaw in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools lets a low‑privileged network user read a limited set of data. The vulnerability is triggered by HTTP requests that bypass authentication checks, resulting in confidentiality leakage without impacting integrity or availability. The weakness is a classic information‑exposure flaw as categorized by CWE-200.

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. The flaw resides in the Report Distribution feature of the PeopleSoft PeopleTools product.

The CVSS 3.1 base score of 4.3 places the exploit in the moderate severity range. Because the attack vector is network‑based (HTTP) and only requires a low privileged user, the exploit is considered easily exploitable. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. Administrators should treat this as a medium threat that can be mitigated with patching and network hardening.