The vulnerability in Oracle Customer Care allows an attacker who can reach the system over HTTP to obtain unauthorized update, insert, delete or read access to data stored in the application. The flaw enables the attacker to change, delete or add records and read a subset of Customer Care data, thereby violating confidentiality and integrity. The weakness is an improper authorization flaw that is triggered by a request that bypasses proper access control checks.

Affected is Oracle Customer Care, part of Oracle E‑Business Suite, for all supported versions from 12.2.3 through 12.2.15. No additional products are directly listed, but the description states that successful attacks may affect other components where Customer Care data is accessible.

The CVSS score of 6.1 indicates a medium severity vulnerability, where the attacker needs network access but no additional privileges. The exploit is considered easily exploitable, with the vector indicating network and low attack complexity, but it requires user interaction from an unrelated party. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the scope has changed, an attacker who abuses this flaw can affect other Oracle products that share data with Customer Care. The overall risk remains moderate, demanding timely mitigation.