Oracle Helidon’s CORS component contains a low‑severity flaw that lets an unauthenticated attacker with network access via HTTP perform unauthorized insert, update or delete operations on accessible data. The vulnerability is marked as difficult to exploit and requires human interaction from a party other than the attacker to complete. The impact focus is on integrity and not confidentiality or availability.

Oracle Helidon, part of Oracle Fusion Middleware, versions 4.0.0 through 4.5.5 are affected.

The CVSS score of 3.1 reflects a low exploitability combined with moderate impact to data integrity. The EPSS score of 0.00217 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not yet a high‑risk target for known exploits. The usable attack vector is over HTTP and requires the attacker to present a request to the CORS endpoint; the description notes that human interaction from a third party is needed, suggesting the threat is mitigated by user awareness and network controls.