This vulnerability exists in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. An unauthenticated attacker who can reach the service over the network via HTTP can exploit the flaw to read critical data or obtain full access to any data exposed by the service. The issue also allows the attacker to trigger a partial denial‑of‑service condition, disrupting the availability of the application. The weakness is a classic example of improper access control, as the system does not enforce authentication before authorizing requests.

Oracle Corporation’s Oracle Commerce Guided Search and Oracle Commerce Experience Manager, version 11.4.0.

The CVSS v3.1 base score of 6.5 indicates a moderate severity level, with confidentiality impact rated high and availability impact low. The EPSS score is less than 1%, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. The attack vector is inferred to be remote over HTTP and does not require authentication; an attacker with network access could exploit it directly. While the exact exploitation conditions are not detailed, the ability to read sensitive data or partially deny service demonstrates that the vulnerability poses a tangible risk to affected deployments.