The vulnerability exists in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools and allows an attacker with low privileges who can access the application over HTTP to perform unauthorized update, insert, delete, or read operations on data to which the user is authorized. The flaw is a failure of access control that can be triggered only when a legitimate user other than the attacker initiates an action, and it may ultimately affect additional PeopleSoft products due to a scope change, compromising the confidentiality and integrity of the affected data.

Version 8.61 through 8.63 of Oracle PeopleSoft Enterprise PeopleTools are vulnerable. The flaw resides in the Panel Processor component, and because the CVE notes a scope change, success may also impact other PeopleSoft applications that use the same component and data structures.

The CVSS 3.1 base score of 4.4 indicates moderate impact to confidentiality and integrity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation. An attacker requires network connectivity over HTTP, must meet high attack complexity, and needs a user not under the attacker’s control to interact with the system. These conditions reduce the likelihood of automated exploitation, but the potential for unauthorized data modification and disclosure warrants timely remediation.