The vulnerability resides in Oracle Product Lifecycle Analytics 3.6.1 and enables a low‑privileged user to gain unauthorized access to critical data stored by the application. It results from improper access control, allowing the attacker to view or manipulate all data accessible through the product. The CVSS assessment indicates a breach of confidentiality only; integrity and availability are not affected.

Oracle Product Lifecycle Analytics version 3.6.1 from Oracle Corporation is affected. No other versions are mentioned. Deployments of this product on a host with user logon privileges are at risk.

The CVSS base score of 5.5 reflects medium severity with a local attack vector and low integrity/availability impact. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, so exploitation probability is uncertain. The vector indicates that possession of local logon rights suffices to exploit the flaw, implying that any service account or basic user on the host can potentially compromise the product. No proof‑of‑concept is reported, but the description states the vulnerability is “easily exploitable.”