The Helidon CORS component in Oracle Helidon allows an unauthenticated attacker with network access to perform update, insert, delete operations and read certain data without authorization. This represents a breach of confidentiality and integrity, potentially changing the scope of impact to other components within the application. The vulnerability is easy to exploit as it requires only HTTP interactions.

Oracle Helidon Fusion Middleware, versions 3.0.0 through 3.2.21, are affected. The vulnerability resides in the helidon-cors component and may affect additional Oracle products that rely on Helidon for web services.

With a CVSS 3.1 base score of 7.2, the risk is high, and the lack of an authentication requirement makes the exploitation straightforward over the network. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, yet the potential for data compromise warrants urgent attention. An attacker can use simple HTTP requests to violate access controls and compromise data confidentiality and integrity.