An access‑control flaw in the Corporate Workflow component of Oracle PeopleSoft Enterprise PeopleTools allows a low‑privileged attacker who can reach the application over HTTP to modify or read data that should be restricted. The vulnerability requires the attacker to gain a remote, network‑level connection, and a human who is not the attacker must interact with the system to enable the attack. Successful exploitation results in unauthorized insert, update, or delete operations, as well as unauthorized read access to a subset of data, thereby compromising the confidentiality and integrity of the affected data. The flaw is categorized as a moderate‑severity error because it does not directly give full system takeover but can undermine business processes and data trust.

Oracle Corporation PeopleSoft Enterprise PeopleTools, specifically the Workflow component. Versions 8.61 through 8.62 are known to be affected.

The CVSS v3.1 score of 5.4 indicates moderate risk with low complexity and low privilege set. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need network access to the PeopleSoft application over HTTP and will need a separate user to interact with the workflow to activate the flaw. Although the risk is moderate, the scope change can allow the impact to extend to other connected products, and therefore the overall risk warrants timely remediation.