An unauthenticated attacker can exploit a flaw in the Helidon microprofile-security component of Oracle Helidon through HTTP requests, enabling unauthorized creation, deletion, or modification of data. The vulnerability arises from missing authentication and authorization controls, making it a violation of CWE-285. Successful exploitation results in high confidentiality and integrity impacts, with the potential to alter or delete critical data within Helidon.

Oracle Helidon versions 4.0.0 through 4.5.5 are affected. This includes all Oracle Fusion Middleware deployments that use Helidon 4.x, particularly the helidon-microprofile-security component. Versions prior to 4.0.0 or 4.5.6 and later are not impacted based on the current vendor statement.

The CVSS 3.1 base score of 9.1 categorizes this flaw as critical, indicating that attacks can be performed remotely without authentication or user interaction. Although no EPSS score is available, the lack of restrictions on network access and the high impact of unauthorized data manipulation suggest a high likelihood of exploitation in exposed environments. The vulnerability is not listed in the CISA KEV catalog, but its similarity to other high‑severity authentication weaknesses warrants proactive remediation.