The flaw is an improper access control that allows an attacker who already holds high‑privilege credentials to send specially crafted HTTP requests to the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools, bypassing normal authorization checks and performing unauthorized updates, inserts, deletions, or reads, and potentially causing a partial denial of service. The CVSS vector shows a high privilege requirement but does not represent privilege escalation; instead, it exploits an existing access level to expand the attacker’s impact within the application.

This weakness affects Oracle PeopleSoft Enterprise PeopleTools, specifically the Fluid Core component in versions 8.61 and 8.62 of the product.

The CVSS v3.1 base score of 6.6 indicates a moderate risk to confidentiality, integrity, and availability. The vulnerability is exploitable over plain HTTP traffic with a high privilege credential requirement and expands scope to allow high‑privileged users to affect additional PeopleSoft modules. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, which leaves the exact exploitation likelihood uncertain but suggests moderation based on the network exposure and credential requirements.