The vulnerability arises from missing authorization checks when processing HTTP requests in Oracle Utilities Application Framework, allowing a low‑privileged attacker on the network to craft requests that perform unauthorized update, insert, delete, or read operations on protected data. The described weakness can be classified as improper access control, leading to confidentiality and integrity risks.

Oracle Utilities Application Framework versions 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4 and 25.10 are affected. Systems that expose the application over HTTP to the internet or untrusted networks are at risk.

The CVSS base score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no active, widely available exploits have been reported. Attackers would likely leverage simple HTTP requests to vulnerable endpoints and require a human user other than the attacker to interact with the system, indicating a potential for targeted internal or socially engineered attacks.