A flaw in Oracle WebCenter Content’s Content Server component allows an attacker with low privileges and network access via HTTP to read a limited set of content that should not be publicly available. The vulnerability is an improper access‑control issue that exposes the confidentiality of the data stored in the server without granting code execution or denial of service.

Oracle WebCenter Content version 14.1.2.0.0 is the only product and version indicated as affected.

The CVSS base score of 3.1 indicates low severity, and the EPSS score of less than 1% shows a very low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. An attacker is believed to need only HTTP network reach to the vulnerable service; the flaw is difficult to exploit and is confined to a small subset of data, so the impact remains limited to confidentiality on systems that expose the service to the network.