The vulnerability resides in the Helidon product’s helidon-security-providers-idcs-mapper component and allows a low‑privileged attacker with local logon to the infrastructure where Helidon runs to compromise the application. Successful exploitation can result in unauthorized access to critical data or total exposure of all data available through Helidon. The weakness manifests as a confidential data breach with no impact on integrity or availability.

Oracle Helidon versions from 3.0.0 through 3.2.21 and from 4.0.0 through 4.5.5 are affected. The issue is confined to the Helidon framework but may affect other Oracle Fusion Middleware products if they interact with Helidon.

The CVSS 3.1 base score of 5.6 indicates moderate vulnerability with high confidentiality impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. The typical attack vector is local access by a low‑privileged user, requiring only that the attacker have a login to the environment where Helidon executes. Because the vector has local access, organizations that enforce strict least‑privilege policies and monitor local logons are less exposed, yet any user with such access can exploit the weakness if the offending component remains unpatched.