The vulnerability in the Open UI component of Oracle Siebel CRM End User permits a local attacker who has logged onto the infrastructure to bypass security controls and obtain unauthorized access to sensitive customer data. The flaw is essentially an access‑control weakness that allows the attacker to read all data that the application can display, leading to a confidentiality breach with no direct impact on integrity or availability.

Oracle Siebel CRM End User 17.0 through 26.9, a component of the Oracle Siebel CRM suite, is affected. This product provides customer relationship management functionality through a web user interface that is exposed to endpoints that can be accessed locally by users with infrastructure login privileges.

The CVSS v3.1 Base Score of 5.5 indicates a moderate severity with local attack vector, low authentication requirement, and no user interaction needed. No EPSS data is reported, so the likelihood of exploitation is unknown, but the vulnerability is fortunately not listed in the CISA KEV catalog. Because it requires local access, the risk is confined to environments where an attacker already has some privileged presence; however, successful exploitation can expose all data accessible through the application, posing a serious confidentiality threat.