The flaw in Oracle Workflow allows an attacker with low privileges and network reachability over HTTP to gain unauthorized access to all data accessible through the system. This results in a confidentiality breach where sensitive workflow information can be read by unauthenticated or low‑privileged users. The vulnerability stems from insufficient access control in the Worklist component and is classified under CVE‑3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a moderate‑severe impact that only compromises confidentiality.

Oracle Corporation’s Oracle Workflow, part of the E‑Business Suite, versions 12.2.3 through 12.2.15 are impacted. End‑users running these releases on public or semi‑public networks are at risk until the product is updated or mitigated.

The CVSS score of 6.5 reflects a Medium overall risk, with no known active exploitation (EPSS not available and not listed in KEV). Because the flaw requires only network access over HTTP, the likely attack vector is a remote attacker within network proximity, such as an attacker on the same internal network or via a compromised VPN. The vulnerability can be confirmed through the presence of sensitive data, but exploitation is considered low effort if a patch is not applied.