The vulnerability resides within the Core component of Oracle REST Data Services, affecting versions 24.2.0 through 26.2.1. It permits a low‑privileged attacker with network access to an HTTP endpoint to perform unprotected update, insert, or delete operations, as well as read data that should be restricted. Such unauthorized data manipulation and disclosure directly compromise confidentiality and integrity, potentially exposing sensitive information and allowing the attacker to alter application state. This issue aligns with Improper Access Control weaknesses (CWE‑250 and CWE‑284).

Oracle Corporation’s Oracle REST Data Services, specifically versions 24.2.0 to 26.2.1 inclusive. The affected component is the Core module of the service, which is the primary interface for exposing application data over HTTP. Systems running any of the listed versions, regardless of operating environment, are at risk.

The CVSS 3.1 base score of 5.4 indicates moderate severity, with low complexity and low privileges required to exploit the flaw via an HTTP request. No EPSS score is available, suggesting limited publicly observed exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. However, the attack vector is network-based and does not require user interaction, meaning that any exposed REST endpoint could be targeted. Until a patch is applied, the risk remains for organizations that allow external network traffic to reach the service or have weak API authentication controls.