A flaw in the Admin Console UI provides a broken access control that allows an unauthenticated attacker to perform update, insert, and delete operations on data, as well as read restricted information. The vulnerability is characterized by CVSS 3.1 score 6.1, reflecting moderate Confidentiality and Integrity impacts. It represents a CWE‑284 type weakness where improper authorization controls expose sensitive functionality.

Oracle Corporation’s Oracle One-to-One Fulfillment, supported versions 12.2.3 through 12.2.15, are affected. The flaw resides in the Admin Console component of the Oracle E‑Business Suite. No other product versions are known to be impacted directly, but the vulnerability’s scope change could potentially affect additional related components.

The CVSS score indicates a moderate risk yet the absence of an EPSS score suggests limited current exploitation data. It is not listed in CISA KEV, and no public exploit has been reported; however, the vulnerability permits unauthenticated network access over HTTP and requires human interaction from a user other than the attacker. Given the potential for unauthorized data modification and disclosure, the risk remains significant for organizations running these product versions.