A vulnerability in Oracle WebCenter Content can be leveraged by a low‑privileged attacker who can reach the application over HTTP. The flaw requires human interaction from a user other than the attacker; once this interaction occurs, the attacker may obtain unauthorized read access to critical data and obtain the ability to update, insert, or delete data. Because the impact is limited to confidentiality and integrity, the vulnerability does not affect availability, but the potential to compromise sensitive enterprise records is significant.

Affected by Oracle Corporation in its WebCenter Content product. Versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable.

The CVSS v3.1 base score is 7.6, indicating a significant risk. The vector shows an attack requires network access over HTTP, low authentication privileges, and user interaction. No EPSS data is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not known to be actively exploited in the wild. Nevertheless, the requirement of a human user other than the attacker implies that social‑engineering or phishing may be necessary, and the scope change can affect other products in a Fusion Middleware environment, raising the overall business risk.