A flaw in the Attachments component of Oracle Document Management and Collaboration allows an attacker with low privileges and network access via HTTP to bypass authorization controls, enabling unauthorized creation, deletion, or modification of documents. The attacker must have a victim user or other human interaction to establish the required permission scope. Successful exploitation can compromise the confidentiality and integrity of all Document Management and Collaboration data and may affect additional integrated products due to a scope change.

Oracle Corporation Document Management and Collaboration, part of Oracle E‑Business Suite, is impacted. Versions 12.2.3 through 12.2.15 are affected.

The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact. Attack requires network access over HTTP, a low‑privilege user, and human interaction, indicating a remotely executable but socially assisted threat. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known widespread exploitation, yet the scope change could allow secondary impact on related products. Organizations should treat this as a high‑severity vulnerability and apply mitigation promptly.