The vulnerability is a flaw in the Open UI component of Oracle Siebel CRM End User that permits a low‑privileged network attacker to gain unauthorized update, insert, delete or read access to data exposed by the application. It is a classic improper access control problem where the system does not correctly enforce the privileges required for these operations. Successful exploitation can lead to modification of data and leakage of sensitive information, impacting both confidentiality and integrity of the compromised data.

Oracle Siebel CRM End User (Open UI) versions 17.0 through 26.9 are affected. These releases are still supported and are listed in the vendor’s security update documentation.

The CVSS base score of 5.4 indicates moderate risk with low confidentiality and integrity objectives. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, implying that large‑scale exploitation has not been observed. The flaw requires network access over HTTP, a low‑privileged user account and human interaction from a person different from the attacker, so the attack is not fully automated but is still plausible in environments with lax access controls.