A vulnerability exists in the Project Control component of Oracle Primavera Unifier that allows a low‑privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of data, as well as read access to a subset of data. The weakness manifests as improper authorization, giving the attacker the ability to bypass normal access controls. The CVSS vector indicates that the attack does not require user interaction and that confidentiality is impacted moderately while integrity is impacted severely.

Oracle Corporation’s Primavera Unifier, versions 23.12.0 through 23.12.16, are affected. The vulnerability targets the Project Control component of these releases, irrespective of the installation environment.

The CVSS score of 7.1 places the vulnerability in the high‑severity range. The EPSS is 0.00296, indicating a very low likelihood of exploitation, and the vulnerability is not yet listed in CISA KEV. The likely attack vector is simple HTTP network traffic to the Primavera Unifier service; a low‑privileged network attacker can exploit the flaw without additional authentication or user interaction. Successful exploitation can lead to significant confidentiality and integrity compromise of Primavera Unifier data.