The vulnerability resides in the helidon-microprofile-security component of Oracle Helidon. It allows an unauthenticated attacker to send HTTP requests that create, delete, or modify data, resulting in unauthorized changes to critical information. The flaw is caused by missing authentication and authorization controls, corresponding to CWE-287 and CWE-306, and leads to confidentiality and integrity violations.

Oracle Helidon versions 4.0.0 through 4.5.5 are affected. These include Oracle Fusion Middleware deployments that use the helidon-microprofile-security component. Versions prior to 4.0.0 or 4.5.6 and beyond are not impacted according to the vendor statement.

The CVSS 3.1 base score of 9.1 designates this flaw as critical, and exploitation can be performed remotely via HTTP without authentication or user interaction. The EPSS score of less than 1% indicates a very low probability of exploitation at present, but the high severity and absence of authentication controls mean that exposed environments remain at risk. The vulnerability is not listed in the CISA KEV catalog. Attackers with network access to the application over HTTP can exploit this flaw.