The Helidon Imperative Web Server component in Oracle Fusion Middleware version 4.5.0 contains a vulnerability that allows an unauthenticated attacker with network access to perform unauthorized creation, deletion or modification of data. The flaw can lead to both confidentiality and integrity violations, giving the attacker full control over all Helidon accessible data. The weakness is a lack of proper access control, as indicated by the high impact on confidentiality and integrity.

Affected: Oracle Helidon 4.5.0, part of Oracle Fusion Middleware. No other versions are listed as vulnerable. The product is accessed over HTTP on the network.

The CVSS 3.1 base score of 7.4 reflects a medium‑to‑high severity risk. Exploitation requires network connectivity to the Helidon service and no user interaction, though the high attack complexity suggests the issue is difficult to exploit. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no confirmed active exploitation yet. Nevertheless, because the vulnerability permits full unauthorized data manipulation, it poses a serious threat to affected deployments.