Oracle Quality, part of Oracle E‑Business Suite, contains a vulnerability that allows an attacker with low privileges and network access via HTTP to bypass authorization controls and gain unauthorized read access to critical data and also perform update, insert, or delete operations on that data. The flaw can lead to confidentiality impact when sensitive information is exfiltrated and integrity impact when data can be altered or removed. The vulnerability is identified by the CVSS3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) and receives a base score of 7.1.

The affected product is Oracle Quality for Oracle E‑Business Suite, with vulnerable versions ranging from 12.2.3 up to and including 12.2.15. Systems running within this version range are susceptible when exposed to the public or internal network through the standard HTTP interface.

The CVSS score of 7.1 indicates a high severity threat, but the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be over HTTP, requiring only low privileged credentials or even no credentials in some configurations. Given the impact on confidentiality and integrity, organizations should treat this as a potentially high risk scenario even with the low EPSS probability.