A vulnerability exists in Oracle PeopleSoft Enterprise HCM Human Resources version 9.2 that permits an unauthenticated attacker to perform unauthorized update, insert, delete, or read operations on certain HR data accessed through the Company Dir / Org Chart Viewer and Employee Snapshot components. The weakness is an improper access control flaw that can lead to partial loss of confidentiality and integrity of organization and employee information, but does not compromise availability or allow code execution.

The affected system is Oracle PeopleSoft Enterprise HCM Human Resources version 9.2, specifically the Company Dir / Org Chart Viewer and Employee Snapshot components. Only this version is listed as vulnerable; no other PeopleSoft or Oracle products are mentioned.

With a CVSS 3.1 base score of 6.1, the vulnerability is moderate in severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA's KEV catalog, indicating a low probability of widespread exploitation. Successful exploitation requires an unauthenticated attacker to send a request over HTTP and relies on a human interaction from a user other than the attacker—most likely a social‑engineering or phishing scenario. If such an interaction occurs, the attacker can modify or delete HR data or read restricted information, potentially leading to privacy breaches or disruptive business impact.