The vulnerability resides in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools. It permits a low‑privileged local attacker to bypass proper authorization controls, allowing read access to critical data. The weakness is mapped to an information‑exposure concept, specifically information exposure (CWE‑200). Because only confidentiality is impacted, the flaw does not alter integrity or availability, yet it can expose sensitive business data.

Affected versions of JD Edwards EnterpriseOne Tools span from 9.2.0.0 through 9.2.26.5. These releases, maintained by Oracle Corporation, include the vulnerable Web Runtime SEC component. Systems running any of these builds must be assessed for the presence of the flaw.

The CVSS v3.1 base score of 5.5 reflects a moderate severity, and the EPSS score of <1% indicates a very low likelihood of exploitation. Based on the description, it is inferred that the attack vector is local because the attacker requires low‑privileged login to the infrastructure where the tools run. The vulnerability is not listed in CISA KEV, suggesting known exploits are not publicly documented. Nonetheless, the combination of local persistence and low privileges makes the threat reasonable in environments where access controls are weak.