This vulnerability allows a low privileged attacker who can reach the WebCenter Content: Imaging service over HTTP to gain unauthorized access to critical data. The flaw resides in improper access control that lets attackers bypass normal authentication checks, resulting in confidentiality impacts but no known integrity or availability effects. The CVSS score of 6.5 reflects a moderate risk profile focused on data exposure.

Affected versions of Oracle WebCenter Content: Imaging are 12.2.1.4.0 and 14.1.2.0.0 as identified by the CNA. These releases contain components that expose data without proper authorization controls.

The attack vector is network-based via HTTP, requiring only local or remote network access. While the EPSS value is not available, the moderate CVSS score and lack of mitigation in the KEV catalog suggest that this flaw can be exploited in environments where the web service is exposed. An attacker with this capability can read all data available to the WebCenter Content: Imaging instance, potentially retrieving sensitive information. No evidence of remote code execution or denial‑of‑service is present, but the confidentiality impact warrants prompt remediation.