The Helidon CORS component in Oracle Helidon allows an unauthenticated network attacker to perform unauthorized update, insert, or delete operations on data exposed through HTTP, as well as read portions of that data without permission. This flaw constitutes both a confidentiality and integrity compromise, as reflected by the CVSS vector that includes low impact on confidentiality and integrity but a high overall score. The weakness stems from insecure handling of cross‑origin resource sharing, mapping to CWE-200.

Oracle Helidon versions 3.0.0 through 3.2.21 are affected. The vulnerability resides in the helidon-cors component and may affect other Oracle products or custom applications that rely on Helidon for web services, potentially expanding the scope of impact beyond the Helidon instance itself.

The CVSS 3.1 base score of 7.2 categorizes this vulnerability as high severity. The EPSS score is less than 1%, indicating a very low current exploitation probability, and it is not listed in the CISA KEV catalog. Nevertheless, the lack of an authentication requirement means that an attacker with network access to Helidon’s HTTP endpoints can craft simple HTTP requests to violate access controls, leading to unauthorized data modification or disclosure. Given the potential for additional products to be impacted, the overall risk remains significant despite the low EPSS.