Oracle Agile Engineering Data Management product (component: Engineering Communication Interface) contains an access control weakness that permits a low‑privileged user with network access via HTTP to read otherwise restricted data. The flaw enables the attacker to retrieve a subset of data that should be confidential, thereby exposing information that the system is intended to protect.

The affected product is Oracle Agile Engineering Data Management, version 6.2.1, part of Oracle Supply Chain. Only this version is listed as vulnerable. The flaw specifically impacts the Engineering Communication Interface component, which handles HTTP requests from external clients.

The vulnerability has a CVSS 3.1 Base Score of 4.3, reflecting moderate confidentiality impact. EPSS is not available, and the flaw is not yet listed in the CISA KEV catalog, indicating that widespread, documented exploitation is not known. Based on the description, it is inferred that a low‑privileged attacker who can reach the system over HTTP can exploit the issue to read sensitive data, so the risk is limited to confidentiality leakage for the exposed subset. The lack of an availability or integrity impact reduces the overall severity, but the data accessed may still be sensitive.