A flaw in Oracle HRMS (US) allows an attacker with a low‑privilege account and network access over HTTP to read confidential data. The weakness permits bypassing normal access controls, resulting in a high confidentiality impact and no denial‑of‑service or integrity loss. The nature of the flaw is an improper authorization check that can be triggered by simply sending a crafted HTTP request.

The vulnerability affects Oracle HRMS (US), a component of Oracle E‑Business Suite, on supported versions ranging from 12.2.3 up to 12.2.15. Systems running any of these releases and exposed over HTTP are at risk.

The CVSS 3.1 Base Score of 6.5 indicates moderate severity; the vector shows that the attack is achievable from the network with low privileges and no user interaction is required. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack path involves an attacker connecting to the HRMS HTTP service, crafting a privileged request that bypasses authorization, and discovering sensitive data. The vulnerability can be exploited without special privileges beyond local user rights, meaning that anyone with network reach to HRMS could potentially harvest confidential information.