The vulnerability exists in the Approvals component of Oracle Purchasing. It allows an unauthenticated attacker with network access via HTTP to trigger actions that, with the cooperation of a user other than the attacker, bypass authentication controls and execute unauthorized update, insert, delete, or read operations on Purchasing data as a result of improper access control and a cross‑site request forgery weakness.

Oracle Purchasing version 12.2.3 through 12.2.15 is affected. The flaw targets the Approvals component, and because the vulnerability can change scope, unauthorized changes may propagate to other Oracle E‑Business Suite components if the data is accessed or modified via the compromised approval workflow.

The CVSS 3.1 base score of 6.1 indicates a medium severity with moderate confidentiality and integrity impacts. The EPSS score of less than 1 % confirms a very low probability of exploitation, and the vulnerability is not included in the CISA KEV catalog. Successful attacks require the attacker to reach the application over HTTP, obtain the cooperation of a separate user, and exploit the cross‑site request forgery condition. The risk can still be mitigated while awaiting a patch by limiting network exposure and enforcing strict authorization controls.