The vulnerability resides in Oracle Product Lifecycle Analytics 3.6.1 and allows a low‑privileged local user, who has logged on to the host where the application runs, to read or potentially manipulate all data accessible to the application. This flaw is an example of improper access control as indicated by the CWE identifiers, and it directly impacts the confidentiality of the stored data without affecting integrity or availability.

Oracle Product Lifecycle Analytics version 3.6.1 from Oracle Corporation is affected. The issue applies to deployments where an attacker can obtain local logon credentials on the underlying operating system. No other product versions or component variants were identified in the advisory.

The CVSS base score of 5.5 reflects moderate severity with a local attack vector and low integrity/availability impact. The EPSS score of <1% indicates a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attack execution requires only local logon rights, implying that any user or service account with basic privileges on the host could potentially exploit the flaw, although no proof‑of‑concept is publicly documented. The impact is confined to confidentiality of critical data.