Oracle Data Integrator stores and processes sensitive data in Oracle Fusion Middleware. A vulnerability in the Market Place component allows an attacker with low privileges and network access over HTTP to bypass authentication controls and create, delete, or modify data. The flaw also enables a partial denial of service that disrupts availability. The weakness is an example of incorrect authorization (CWE‑862).

Vulnerable releases include Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0. These versions are deployed in many enterprise environments that use Oracle Fusion Middleware for integration tasks. All installations of these versions that expose the Market Place interface are affected.

The CVSS 3.1 base score of 8.3 reflects high impact to confidentiality, integrity, and availability. The EPSS score of less than 1% indicates that the exploit is currently uncommon, but the vulnerability is described as easily exploitable, so it remains a significant risk. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely over HTTP, requiring only low‑privilege credentials, and can gain unauthorized manipulation of critical data or cause a partial denial of service.