The vulnerability in Siebel CRM Cloud Applications allows a low‑privileged attacker with network access to read a subset of data through the Siebel Cloud Manager component. The flaw is an authorization bypass weakness (CWE-863), leading to a confidentiality impact and giving the attacker unauthorized access to information that should be protected.

Oracle's Siebel CRM Cloud Applications (Siebel Cloud Manager component) are affected. Versions 22.3 through 26.9 are known to contain the flaw. The vulnerability applies to environments exposed to HTTP traffic.

The CVSS Base Score is 3.1, reflecting a limited confidentiality impact. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. The likely attack vector is a remote HTTP request from an attacker possessing only low privileges, making exploitation possible but not trivial. Overall risk is moderate; while the severity is low, the data exposure could be valuable to an adversary and should be addressed proactively.