The vulnerability is an authorization bypass in the PeopleSoft Portal component of PeopleSoft Enterprise PeopleTools, allowing an unauthenticated user with network access over HTTP to read a subset of application data and perform update, insert or delete operations on data governed by the portal. This results in confidentiality impact, with the possibility for integrity compromise via unauthorized data manipulation. The weakness corresponds to missing authentication and authorization controls (CWE‑306) and also constitutes an information disclosure vulnerability (CWE‑200).

Oracle PeopleSoft Enterprise PeopleTools, Portal component, versions 8.61 through 8.63, are affected. The product is impacted when exposed to the public network and configured with default settings, as the fault is triggered by unauthenticated HTTP requests.

The base CVSS score of 4.8 denotes moderate severity but with limited confidentiality and integrity impact, and the EPSS score of less than 1 % indicates a low likelihood of widespread exploitation. The flaw is not currently listed in the CISA KEV catalog. Attackers could exploit the weakness from any host with network connectivity to the PeopleSoft portal over HTTP, requiring no credentials and no elevated privileges. Although automated exploits are not reported, the ability to alter or view sensitive data remains a significant risk for exposed systems.