Oracle REST Data Services allows a low‑privileged attacker with network access over HTTPS to influence the system, provided that a non‑attacker user interacts with the application. The flaw permits unauthorized creation, deletion, or modification of critical data and offers complete read access to all data exposed through the service. Additionally, an attacker can partially deny service to legitimate users. This combination of confidentiality, integrity, and availability violations yields a CVSS 3.1 base score of 7.9 (C:H, I:H, A:L).

Affected products are Oracle REST Data Services offered by Oracle Corporation. Versions from 24.2.0 through 26.1.0 are vulnerable. The impact extends beyond the REST service, as a scope change in the CVSS vector indicates that exploitation may affect additional Oracle products that interact with the REST layer. The vulnerability is exploitable via HTTPS over the network.

The CVSS score reflects high confidentiality and integrity risk, but a low availability impact. EPSS is not provided, suggesting insufficient data on exploitation frequency; however, the user interaction requirement means that attackers would likely need to luring or abusing system users, which reduces the likelihood of widespread exploitation. KEV does not list this issue, so there is no evidence of active exploitation at this time. Nevertheless, given the potential for data loss and disruption to critical services, the vulnerability warrants prompt attention.