This vulnerability permits an unauthenticated attacker who can reach the system over HTTP to create, delete or modify content in Oracle WebCenter Content. The flaw resides in the Content Server component and effectively bypasses normal access controls, granting the attacker the same privileges as a legitimate user. The impact is loss of confidentiality and integrity of data, and potential unauthorized deletion of critical information.

Affected products include Oracle WebCenter Content version 12.2.1.4.0 and 14.1.2.0.0, both part of Oracle Fusion Middleware. The vulnerability is present across these releases and may also influence other WebCenter or Fusion Middleware components if they share authentication mechanisms.

The CVSS 3.1 base score of 8.7 reflects high severity. No EPSS score is available and the vulnerability is not yet listed in the CISA KEV catalog. The attack is likely carried out over the public network via HTTP by exploiting the lack of authentication checks in the Content Server. Because the flaw changes the scope to all content, a successful exploit can give the attacker full access to all data stored in the affected WebCenter Content instances.