This vulnerability exists in the Query component of Oracle PeopleSoft Enterprise PeopleTools. It can be triggered by a low‑privileged user that has network connectivity to the application over HTTP. Successful exploitation allows the attacker to read confidential data that should otherwise be restricted, with the attack scope expanding to other PeopleSoft products. The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) indicates that while the exploit is network‑based and requires low privilege, it can lead to a limited confidentiality breach.

Affected versions are Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63. The vulnerability is specific to the Query module and is not known to affect other product releases outside this range.

The base score of 5.0 places this issue in the medium severity range. The EPSS score is currently unavailable, and it is not listed in the CISA KEV catalog, suggesting no public evidence of exploitation yet. Nonetheless, the low attack complexity and local privilege requirement mean an attacker with network access could reverse the confidentiality impact without needing higher privileges or remote code execution.