The vulnerability originates in the helidon-security-providers-idcs-mapper component of Oracle Helidon, allowing a low-privileged user with local logon to the host where Helidon runs to obtain unauthorized access to critical data or all data exposed through Helidon. This represents a privilege escalation and authorization bypass (CWE-284) that can result in a confidentiality compromise.

Oracle Helidon versions 3.0.0 through 3.2.21 and 4.0.0 through 4.5.5 are affected. The issue is confined to the Helidon framework but may impact other Oracle Fusion Middleware products that consume Helidon services.

The CVSS 3.1 base score of 5.6 indicates moderate severity with a high confidentiality impact. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The typical attack vector is local access by a low-privileged user; no network or elevated privileges are required. Because the vulnerability is local, organizations with strict least-privilege policies and active monitoring of local logins can reduce exposure, though any user who can log in to the environment remains at risk.