The vulnerability resides in the Work Order Management component and is a case of improper authorization (CWE‑284). It allows a low‑privileged attacker with network connectivity over HTTP to bypass normal access controls and read all business data. The flaw does not affect integrity or availability, but it severely impacts confidentiality by allowing full data traversal.

Affected is Oracle Corporation’s PeopleSoft Enterprise FIN Maintenance Management product, version 9.2. No other versions or variants are noted.

The CVSS 3.1 base score of 6.5 indicates medium severity. The EPSS score is low, at <1%, and the flaw is not listed in the CISA KEV catalog. The attack vector AV:N/AC:L/PR:L/UI:N/S:U shows that a network attacker can reach the vulnerable HTTP interface with low privileges. No public exploit information is available.