The vulnerability in Oracle WebCenter Content, part of Oracle Fusion Middleware, allows a low privileged attacker with network access over HTTP to gain unauthorized access to critical data and, in some cases, modify, insert, or delete that data. The weakness permits a scope change, meaning exploitation could affect additional Oracle products beyond WebCenter Content itself, thereby potentially compromising a broader set of organizational information. This breach of confidentiality and integrity could enable attackers to read protected content or tamper with the data repository without triggering immediate system alerts.

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These deployments typically run within larger Oracle Fusion Middleware environments, so the impact may extend to related services that interact with the content server.

The CVSS score of 7.1 indicates a medium severity flaw with high confidentiality impact. The attack vector is remote over HTTP, the attacker only needs low privileges, and no user interaction is required. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that concrete exploit evidence is not public at this time. Nonetheless, the scope change raises the risk of broader compromise if the same access control weakness exists in other connected components.