The vulnerability in Oracle WebCenter Content allows an attacker with low privileges and network access to HTTP endpoints to gain unauthorized read and modify access to critical data. It can also enable unauthorized insert, update, or delete operations on content that is otherwise protected. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) shows that the exploit requires network connectivity, high attack complexity, and user interaction from a non‑attacker, yet it can change the privilege scope and compromise confidentiality and, to a lesser extent, integrity of the content.

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable. Because the scope flag is set to changed, successful exploitation may also affect additional components of Oracle Fusion Middleware that rely on WebCenter Content.

The CVSS Base Score of 6.5 indicates moderate severity. Exploitation requires network reachability and human interaction, which lowers the likely probability of attack; EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the ability to read, alter, or delete sensitive content represents a significant risk to data confidentiality and integrity, warranting immediate remediation.