A flaw in the access and security controls of Oracle Hyperion Data Relationship Management allows a low‑privileged attacker who can reach the application over HTTP to create, delete, or modify data without proper authorization. This flaw is an example of improper access control (CWE‑284) and results in leaking, altering, or destroying critical data, thereby compromising confidentiality and integrity of the entire system.

The vulnerability is specific to Oracle Hyperion Data Relationship Management version 11.2.25.0.000 shipped under the Oracle Hyperion brand. Any instance of this version that is exposed to HTTP traffic is susceptible.

The CVSS v3.1 base score of 8.1 indicates that the flaw is quite severe, with high confidentiality and integrity impacts and a low attack complexity. The EPSS score is 0.00392 (<1%), indicating a very low probability of exploitation in the general population, although the vulnerability is technically easy to exploit. It is not listed in CISA’s KEV catalog at this time. Based on the description, the likely attack vector is an unauthenticated or minimally privileged user sending crafted HTTP requests to the affected component, exploiting an improper access control to gain elevated privileges.