A low‑privileged attacker with network access over HTTP can exploit a flaw in Oracle Demand Planning 12.1 and 12.2 that requires user interaction from a third party to obtain unauthorized access to critical planning data. The vulnerability allows bypass of authentication checks through improper access control and inadvertent disclosure of sensitive information (CWE‑200), resulting in the potential to read all data visible to the Demand Planning application. The CVSS v3.1 base score of 6.8 reflects a moderate severity focused on confidentiality impact.

Affected systems are Oracle Demand Planning versions 12.1 and 12.2, as documented in the Oracle CPU October 2026 security alert. System administrators should confirm that these versions are running and assess whether the Demand Planning HTTP interface is exposed to the Internet or to untrusted internal networks.

The AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N vector indicates that the vulnerability is network‑based, requires low privilege and user interaction, and changes the scope to cover all accessible data. The EPSS score of less than 1% and absence from the CISA KEV catalog suggest that public exploits are currently rare but the inherent attack path remains possible. If unpatched, an attacker who can reach the HTTP interface and convince a user to click a crafted link could compromise confidentiality of all planning data.