The vulnerability in Oracle WebCenter Content allows a local attacker who already has a low‑privilege logon to the infrastructure hosting the application to gain unauthorized access to the entire content repository. Because the flaw bypasses normal access controls, the attacker can read or otherwise manipulate data with no restrictions, but the impact is limited to confidentiality. The issue originates in the Content Server component and can be leveraged to affect other products running in the same environment.

Affected versions are Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0, as released by Oracle Corporation. These versions run within the Oracle Fusion Middleware suite and are identified by the CPE strings provided.

The CVSS base score of 6.5 indicates moderate severity. Although EPSS information is unavailable and the vulnerability is not listed in CISA’s KEV catalog, the local nature of the attack means any user with limited credentials on the same host can exploit it. The likely attack vector is a local privilege escalation or misconfigured access control within the WebCenter Content server. If a local user can log into the host, they can trigger the flaw, read critical data, and potentially use the compromised data to pivot to other systems.