This vulnerability enables a low privileged user who can log on to the infrastructure hosting Siebel CRM Cloud Applications to read a subset of data that should be protected. The weakness originates in the Siebel Cloud Manager component, where input validation and access controls are insufficient, allowing unauthorized data disclosure but not modification or denial of service. The impact is limited to confidentiality: sensitive business data exposed to an attacker with local access.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9 are affected. The issue exists in Siebel Cloud Manager, the component that manages the application environment.

The CVSS 3.1 base score of 3.3 indicates a low severity vulnerability with a moderate likelihood of exploitation. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is local: an attacker must have a logon to the infrastructure and low privileges, after which they can read permitted data without additional escalation.