A flaw in the access and security module of Oracle Hyperion Data Relationship Management permits an unauthenticated attacker that can reach the service over HTTP to compromise the application. The vulnerability allows the attacker to obtain full access to all data exposed by the product, thereby leaking confidential information. It is an access‑control weakness that directly impacts confidentiality without affecting integrity or availability.

The affected product is Oracle Hyperion Data Relationship Management version 11.2.25.0.000, distributed by Oracle Corporation. No other versions or products are listed as impacted.

The CVSS 3.1 score of 7.5 indicates a high severity for lack of authentication. Exploitation requires only network connectivity to the HTTP interface, meaning the attack vector is publicly reachable. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but its High CVSS and open network exposure mean that active attackers could attempt exploitation.