The vulnerability allows an unauthenticated attacker to connect over HTTP and bypass authentication controls, enabling unauthorized access to critical data stored in Oracle Communications Unified Inventory Management. The flaw results in a confidentiality compromise while leaving integrity and availability untouched. The attacker gains read access to all data exposed by the application, potentially revealing sensitive inventory information.

Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1 are affected. The weakness is present in the Security component, specifically around HTTP access paths that lack proper access control.

The vulnerability carries a CVSS v3.1 base score of 7.5, indicating moderate to high severity. EPSS data is not available, making precise exploitation likelihood unknown, but the attack requires only network access to HTTP which is widely available. The flaw is not listed in the CISA KEV catalog, yet the mentioned attack vector and high confidentiality impact warrant attention. Under the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), an attacker can exploit the weakness without authentication or UI interaction, underscoring its potential for covert compromise.