A vulnerability in the Oracle Applications Framework Personalization component allows a high‑privileged attacker who can reach the application over HTTP to perform unauthorized updates, inserts, deletes, and reads of data accessible through the framework, and to trigger a partial denial of service. The weakness stems from improper access control that can be exploited by an attacker with sufficient privileges, enabling significant integrity, confidentiality, and availability impacts.

Oracle Corporation Oracle Applications Framework versions 12.2.9 through 12.2.15 are affected. These releases run in Oracle E‑Business Suite environments where the Personalization feature is deployed.

The CVSS 3.1 base score of 4.7 indicates moderate overall severity. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is network‑based (HTTP) and the exploitation requires a high‑privileged attacker. Once such privileges are achieved, the attacker could compromise data integrity and availability within the framework.