An authentication flaw in the Open UI component of Oracle Siebel CRM End User allows a low‑privileged attacker who can reach the application over HTTP to bypass normal access controls and read data that should be protected. The vulnerability does not require any special user interaction, and the attacker only needs basic networking connectivity to target the application. Based on the description, it appears the vulnerability does not provide direct arbitrary code execution, but it does enable unauthorized access to sensitive data through the CRM interface.

Oracle Corporation’s Siebel CRM End User product, specifically versions 17.0 through 26.9, is affected. These releases include the Open UI component that is vulnerable to the described authentication bypass.

The issue carries a CVSS 3.1 Base Score of 6.5, indicating a moderately high confidentiality impact and no integrity or availability effects. The attack vector is network‑based, the attacker needs only low privileges, and no user interaction is required. Exploitation probability is very low, with an EPSS score of <1%, and the vulnerability is not listed in the CISA KEV catalog. Given its ease of exploitation via HTTP, the risk to organizations that expose Siebel CRM End User to the network remains significant, particularly if no defensive controls are in place.