A vulnerability exists in the Open UI component of Oracle Siebel CRM End User that permits a low‑privileged attacker with network access over HTTP to perform unauthorized updates, inserts, or deletes of certain CRM data, as well as read restricted data, thereby breaching confidentiality and integrity. The CVE description does not state the root cause explicitly, but the nature of the impact suggests an access control issue; this inference is drawn from the limited privileges accessed.

Oracle Corporation’s Siebel CRM End User product, versions 17.0 through 26.9, is affected. The issue targets the Open UI component accessed via standard HTTP interfaces.

The CVSS v3.1 score of 5.4 reflects moderate severity with compromise of confidentiality and integrity. No EPSS score is available and the vulnerability is not listed in CISA KEV, but the attack vector is network‑based HTTP, requiring only low privileges. Given the lack of mitigation published beyond patching, the risk remains significant for environments exposing Siebel CRM to external traffic.