Vulnerability exists in the Open UI component of Siebel CRM End User and permits an unauthenticated attacker with network access over HTTP to change, insert, or delete data within the application, compromising data integrity in the system. This flaw is a missing credential validation vulnerability, classified as CWE-306, and is exploited by accessing the exposed endpoint without authentication and manipulating data objects that should be protected. The impact is limited to integrity; confidentiality and availability are not directly affected by the description provided.

Oracle Siebel CRM End User, versions 17.0 through 26.9, is impacted by this issue. The affected vendor product is listed in the CNA data for Oracle Corporation and consists of the Siebel CRM End User product. No further version granularity beyond the 17.0-26.9 range is given.

The CVSS base score of 3.7 indicates a low severity impact focused on integrity. The EPSS score is <1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attacker requires unauthenticated network access via HTTP, which is a high attack complexity scenario. The vulnerability is described as difficult to exploit, suggesting that a skilled attacker may be required. Because the vector is remote and public, the potential for exploitation exists if the Open UI interface is reachable from untrusted networks.