The flaw is an improper privilege management weakness (CWE-269) that permits a user with high privileges and network access via HTTP to create, delete, or modify critical data within PeopleSoft Enterprise HCM Absence Management. Successful exploitation results in unauthorized modification of critical records and full data access, impacting both confidentiality and integrity of the system. The vulnerability’s nature is a privilege escalation via HTTP requests, allowing the attacker to bypass normal access controls.

Oracle Corporation’s PeopleSoft Enterprise HCM Absence Management version 9.2 is affected. No other versions are listed as susceptible.

The CVSS base score of 6.5 indicates medium severity, and the lack of an EPSS score makes the likelihood of exploitation uncertain. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is over the network using HTTP and requires the attacker to possess high‑privilege credentials within the PeopleSoft environment, which can lead to significant data integrity compromise.