The vulnerability resides in the Identity Console component of Oracle Identity Manager, enabling an attacker who can reach the system over HTTP to perform unauthorized create, update or delete operations as well as read a subset of protected data. The flaw is characterized by a lack of proper authentication enforcement and improper authorization checks, allowing a non‑authenticated attacker to manipulate data only after a human interaction from a third‑party user. The damage includes loss of data integrity and confidentiality for the affected datasets.

Oracle Identity Manager version 12.2.1.4.0 and 14.1.2.0.0 are impacted. These releases are components of Oracle Fusion Middleware and provide identity and access management services for enterprise environments.

The CVSS score of 6.1 indicates moderate severity with low confidentiality and integrity impacts. The vector states that the attack occurs over network as a non‑authenticated attacker, but a human interaction from a user other than the attacker is required to complete the exploit. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Since the flaw requires a third‑party interaction, the likelihood of a widespread automated exploitation is limited, but the potential for targeted attacks remains. Organizational defenses should focus on patching and network segmentation, given the moderate CVSS and the possibility of scope escalation.