The vulnerability enables an unauthenticated attacker who can reach the Siebel Cloud Manager over HTTP to read a subset of data stored in Siebel CRM Cloud Applications, resulting in a confidentiality impact because sensitive information becomes accessible without authentication. This weakness pertains to inadequate access controls that allow data to be exposed without proper authorisation.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 are affected. Clients using those releases of the Siebel Cloud Manager component can acquire data over the network without authentication.

The base CVSS score of 5.3 indicates a moderate severity with a plain network attack vector, low complexity, and no privileged access required. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can reach the HTTP service can trivially exploit this by sending a crafted request, resulting in a leakage of information, but no escalation of privileges or denial of service is described.