A remote exploitation flaw in Oracle Life Sciences Central Designer allows an attacker with limited privileges to access sensitive data over HTTP. The vulnerability effectively bypasses proper authorization controls, exposing confidential information to unauthenticated or low‑privileged users. It represents an improper authorization weakness, enabling attackers to read or potentially modify critical data within the application.

Oracle Life Sciences Central Designer version 7.0.1.0 is affected. This is the specific release of the Oracle Health Sciences Applications Platform that contains the flaw.

The issue carries a CVSS 3.1 base score of 6.5 and an EPSS of less than 1 %. No public exploits have been indexed in the CISA KEV catalog. Successful exploitation requires only network access to the HTTP interface and does not need user interaction. Once accessed, an attacker can read all data that the application exposes without having to elevate privileges beyond the initial low‑privileged state.