A vulnerability in the Oracle Applications Framework Personalization component allows a high‑privileged attacker who can reach the application over HTTP to perform unauthorized updates, inserts, deletes, and reads of data accessible through the framework, and to trigger a partial denial of service. The weakness stems from improper access control that can be exploited by an attacker with sufficient privileges, enabling significant integrity, confidentiality, and availability impacts that map to CWE‑284.

Oracle Corporation Oracle Applications Framework versions 12.2.9 through 12.2.15 are affected. These releases run in Oracle E‑Business Suite environments where the Personalization feature is deployed.

The CVSS 3.1 base score of 4.7 indicates moderate overall severity. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack vector is network‑based (HTTP) and the workaround is easily applied, so exploitation is considered both feasible and likely for environments with accessible HTTP endpoints and high‑privileged users. Attackers would require high privileges to act, but once achieved, they could compromise data integrity and availability within the framework.