Oracle Workflow contains an authorization bypass in its Workflow Loader component that allows an attacker who already has high privileges to perform unauthorized insert, update or delete operations on Workflow data and to trigger a partial denial of service. This flaw directly impacts the integrity and availability of Oracle Workflow accessible data, while the confidentiality impact is limited. Based on the description, the vulnerability requires the attacker to reach the system via HTTP and to hold high‑level credentials on the host.

Oracle Corporation’s Oracle Workflow product, part of Oracle E‑Business Suite, is affected in the versions spanning 12.2.3 through 12.2.15. The flaw is located in the Workflow Loader component of these releases. Systems running these versions should verify the installation of the loader module.

The CVSS 3.1 base score of 5.5 indicates moderate severity with low to moderate impact on integrity and availability. The EPSS score is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted HTTP requests to the Workflow Loader endpoint when they already possess high‑privilege access. The likely attack vector is network access via the exposed HTTP interface, and the risk is bounded by the prerequisite of high privileges.