This vulnerability arises from a flaw in the Common Security component of Oracle Hyperion Infrastructure Technology. It permits an unauthenticated attacker who can reach the application over HTTP to perform unauthorized updates, inserts, or deletions of data, as well as read restricted data. The flaw is a direct result of improper access control that allows input from non‑authenticated users to influence privileged operations, leading to confidentiality and integrity violations.

The affected product is Oracle Hyperion Infrastructure Technology version 11.2.25.0.000. Only this version is explicitly listed as vulnerable, and no other versions or components are noted as impacted.

The CVSS 3.1 score of 6.1 indicates moderate severity, with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L. Exploitation requires a human click or interaction, but once triggered it can modify data across the scope. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, meaning there is limited evidence of widespread exploitation. However, because it allows an unauthenticated user to access the system over the network and modifies data, organizations should treat it as potentially high risk if the product is exposed to external networks.