The vulnerability exists in the PeopleSoft Enterprise PeopleTools portal component for versions 8.61 through 8.63. It allows a low‑privileged attacker who can reach the application over HTTP to bypass authorization checks and read sensitive or all data the portal can provide. While it does not enable code execution, the flaw constitutes an authorization bypass (CWE‑863) and also reveals confidential data (CWE‑200).

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically the portal module, is affected in versions 8.61, 8.62, and 8.63. Earlier releases (prior to 8.61) and later releases (after 8.63) are not impacted according to the vendor’s advisory. The vulnerability is limited to the portal component and does not affect other PeopleSoft modules.

The CVSS v3.1 base score is 5.3, reflecting a medium severity focused on confidentiality. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been confirmed. Attackers require network access to the PeopleSoft portal over HTTP and only need low privileges; they cannot execute code but can retrieve any data the portal can display to authenticated users, potentially exposing large amounts of sensitive business information.