The flaw is an authorization bypass (CWE‑284) in the Oracle Product Hub’s Item Catalog component, allowing a low‑privileged attacker with network access over HTTP to read, update, insert, or delete data and to trigger a partial denial of service. Successful exploitation would grant the attacker full read/write/delete capabilities on all data exposed by Product Hub, and because the vulnerability allows a scope change, the impact could extend to other Oracle E‑Business Suite components. Although exploitation is described as difficult, the potential damage includes confidentiality and integrity compromise and availability degradation.

Oracle Corporation’s Oracle Product Hub for Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15, is affected. The impact may extend beyond Product Hub to other related components because the vulnerability’s scope changes.

The CVSS score of 7.7 indicates high severity, with moderate potential impact on confidentiality, integrity, and availability. The EPSS score is unavailable, and the issue is not yet listed in the CISA KEV catalog. Attackers must first reach Product Hub over HTTP and possess low‑privilege credentials; the flaw is described as difficult to exploit, but once exploited it provides the attacker with full read/modify access to all data exposed by Product Hub and the ability to degrade its availability at least partially.