This vulnerability in Oracle REST Data Services allows a low‑privileged attacker with network access via HTTP to gain unauthorized access to critical data or full access to all data exposed by the service. The flaw permits unauthorized reading of sensitive information, constituting an information exposure (CWE‑200) vulnerability. The impact is elevated confidentiality loss, as sensitive information can be read or modified, and the scope of the vulnerability may extend to other products integrated with the REST service.

Oracle REST Data Services versions 24.2.0 through 26.2.2 are affected. The vulnerability is specifically in the Core component and can impact any deployment using these versions.

The CVSS v3.1 Base Score is 7.7, indicating a high risk level. The EPSS score is 0.00371, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The description and vector indicate that the attack can be performed over the network via standard HTTP, and the scope change suggests that exploitation may propagate to related components. An attacker who can reach the REST interface, even with limited privileges, can exploit the flaw to read sensitive data.