The vulnerability lies in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition, enabling a low‑privileged attacker that can reach the HTTP interface to create, delete, modify, or read data that should be protected. This allows unauthorized alteration of critical business data as well as disclosure of sensitive information. This weakness is a classic example of an improper access control flaw (CWE-284) and is also related to inadequate authorization checks (CWE-862). The flaw results in a breach of confidentiality and integrity of all business data exposed by the platform.

Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 are affected. The advisory notes that exploitation of the BI Platform may also impact other Oracle products that share the same authentication or data layers, indicating a potential scope change beyond BI Enterprise Edition.

CVSS v3.1 gives the bug a Base Score of 7.1, classifying it as high severity and demonstrating significant confidentiality and integrity impact. The EPSS score is less than 1%, which suggests a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the HTTP interface when the attacker has network access to the BI platform, requiring only low‑privileged credentials and no user interaction. Because no elevation beyond local privileges is needed, the attack can be performed remotely by any adversary who can reach the web service.