Oracle Trusted Answer Search includes a flaw in its PL/SQL package that permits a low‑privileged attacker with network access via HTTP to compromise the application. Successful exploitation can reveal sensitive data or provide full access to all data stored by the component. The vulnerability directly jeopardizes confidentiality and demonstrates an improper access control weakness.

Oracle Trusted Answer Search version 26.1 is affected. Administrators who maintain this product must verify that this exact version is installed and evaluate whether it is exposed to public or internal networks that may allow unauthenticated HTTP traffic.

The flaw carries a CVSS 3.1 base score of 6.5, indicating moderate risk, and the EPSS score is not available, so the probability of exploitation is uncertain. The attack vector is network‑based via HTTP, and the attacker requires only limited privileges, implying that the vulnerability is easily exploitable. The vulnerability is not listed in CISA’s KEV catalog, but the potential for data compromise warrants prompt mitigation.