The Oracle Common Applications Calendar product of Oracle E-Business Suite suffered a vulnerability that allows an attacker with low privileges but network access via HTTP to create, delete, modify, or read sensitive calendar data. By exploiting this flaw, an attacker can compromise the confidentiality and integrity of the application’s data, potentially causing unauthorized data leakage, corruption, or loss. The flaw is inherent in the application’s improper access control logic, enabling unprivileged users to perform privileged operations.

Oracle Common Applications Calendar, part of Oracle E-Business Suite, is affected in versions 12.2.3 through 12.2.15. The vulnerability applies to the Applications Calendar component of the product. No other versions are known to be impacted by this flaw.

The CVSS v3.1 base score is 7.1, indicating a high severity with a significant impact on confidentiality and integrity. The EPSS score is below 1%, suggesting a low but non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be triggered remotely over HTTP by an attacker who already has a local or network account or is able to access the network. Because the required privileges are low, the attack could be launched from a compromised internal user or an external attacker who gains network access through spear-phishing or other means. The lack of a user interface requirement means the attacker can run the exploit automatically; therefore, security teams should treat this as a credible threat.