This vulnerability in the Oracle Application Development Framework Security Framework permits an unauthenticated attacker with HTTP network access to perform unauthorized update, insert, or delete operations on data accessible to ADF. The flaw also allows reading of restricted data subsets. Attack requires human interaction from another user, so it is not a purely automated remote code execution but still enables significant confidentiality and integrity violations. The weakness is a classic example of improper access control, undermining data protection.

The affected components are Oracle Application Development Framework versions 12.2.1.4.0 and 14.1.2.0.0, part of Oracle Fusion Middleware. These are deployed in enterprise environments and may be exposed to external networks. Affected users include Oracle ADF administrators and any application that relies on the ADF security framework.

The vulnerability scores a CVSS v3.1 Base Score of 6.1, indicating moderate severity. The EPSS score is below 1%, suggesting low current exploit probability, and the issue is not listed in the CISA KEV catalog. However, the flaw allows unauthorized data manipulation with network access and could affect additional products due to scope change. The likely attack vector is over HTTP, requiring an unauthenticated attacker who can also convince another party to assist. Given the moderate score and low exploit likelihood, the risk is considered moderate but warrants prompt patching.