Oracle Hyperion Calculation Manager contains a low‑privilege vulnerability that can be triggered via HTTP. Attackers with limited local privileges who can reach the HTTP interface may read a subset of data that they are not authorized to view. The impact is a confidentiality breach, reflected by a CVSSv3.1 base score of 3.1. The exploit conditions require network access and a relatively high attack complexity, making successful exploitation moderately difficult.

The vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000. This is the only affected version listed by Oracle. No other products or versions are impacted according to the available data.

Given the high attack complexity and the need for network access to the Hyperion HTTP endpoint, the likelihood of successful exploitation is low, as reflected by an EPSS score of <1%. No publicly available exploits have been reported, and the vulnerability is not listed in CISA’s KEV catalog. However, because the flaw allows unauthorized access to sensitive data, organizations should treat it as a confidentiality risk and consider mitigating controls. The CVSS score of 3.1 indicates low but non‑zero risk, particularly in environments where the affected component is exposed to untrusted networks.