The vulnerability allows a low privileged attacker with network access via HTTP to exploit a flaw in the Push Notifications component of Oracle PeopleSoft Enterprise PeopleTools. Successful exploitation enables the attacker to perform unauthorized insert, update, or delete operations on accessible data as well as read unrestricted subsets of that data, compromising the confidentiality and integrity of the application. The flaw is classified as an improper authorization weakness, where the system fails to enforce sufficient permissions for these operations.

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.60, 8.61, and 8.62 are affected. The issue resides in the Push Notifications component that delivers messages to end users. Organizations running any of these versions with exposed HTTP endpoints are vulnerable.

The CVSS v3.1 base score of 5.4 indicates a moderate severity with low privilege required. The EPSS score of less than 1% suggests a low probability of exploitation in the general population. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be network-based over HTTP, requiring only local or network-level authentication and no console or administrative privileges, illustrating that attackers could compromise the system from within the network or over the public Internet if the endpoint is reachable.