This vulnerability exists in the Open UI component of Oracle Siebel CRM End User. An attacker who can reach the application over HTTP can potentially send malicious requests that cause unauthorized updates, inserts, or deletions of data accessible through the interface, thereby harming the integrity of the system. The weakness is cross‑site request forgery. The CVE description does not detail an exact exploitation path, so the attack vector is inferred to require the attacker to trick an authenticated user into visiting a crafted URL or submitting a forged form while the target is still authenticated.

Affected vendors include Oracle Corporation. The product impacted is Siebel CRM End User, specifically the Open UI component. Versions 17.0 through 26.9 are vulnerable.

The CVSS base score of 3.1 indicates low severity, yet the impact is on integrity. The EPSS score is below 1%, reflecting a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack requires network access via HTTP and a second human user to be present, which reduces the likelihood of a direct exploit but still permits data tampering if the conditions are met.