Oracle Report Manager accepts HTTPS requests that can be composed to exploit an improper access control flaw. A low‑privileged attacker who can reach the service over the network can gain unauthorized read access to sensitive data stored in the Report Manager, potentially accessing all documents and reports. The same flaw also enables the attacker to cause a partial denial of service, interrupting the availability of the Report Manager for authorized users. The weakness stems from a missing or bypassed privilege verification during request handling.

Vulnerable versions are Oracle E‑Business Suite Report Manager from version 12.2.3 through 12.2.15. This includes the internal operations component of the product. Users running any of these releases, particularly those exposed to external network traffic over HTTPS, are at risk.

Because the attack can be performed from a low‑privileged account and requires only network connectivity, the likelihood of exploitation is moderate. The CVSS base score of 7.1 indicates substantial confidentiality impact with high risk for data exposure and lower availability impact. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, which suggests that it has not yet been widely exploited in the wild. Nevertheless, attackers could target exposed instances to gain unauthorized insight into critical business data or temporarily disrupt services.