The vulnerability in Oracle WebCenter Content allows an attacker with network access over HTTP to perform unauthorized updates, inserts, or deletions of data, and to read protected data. The flaw is a broken access control that does not enforce proper authorization checks, compromising data integrity and confidentiality. Successful attacks require the attacker to prompt a legitimate user to interact with the system, after which the malicious payload is executed.

Affected systems are Oracle WebCenter Content version 12.2.1.4.0 and version 14.1.2.0.0, both part of Oracle Fusion Middleware.

The CVSS 3.1 base score of 6.1 indicates moderate severity with moderate confidentiality and integrity impacts. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires exploit of the HTTP interface, does not need authentication, but relies on a human interaction to complete the attack. The scope change may extend impact to additional Oracle Fusion Middleware products.