The Oracle Siebel Customer Order Management Order Management component contains an access control flaw that permits low‑privileged users who can reach the service over HTTP to modify, delete, or insert records, read sensitive data, and cause a partial denial of service, all without needing to authenticate as a privileged user. The flaw requires a secondary user to interact with the web interface, so the attacker must coerce a legitimate user into performing an action that triggers the vulnerable code. The impact encompasses confidentiality, integrity, and availability damage, including unauthorized data exposure, loss, or modification and possible disruption of order processing.

The vulnerability affects versions of the Siebel Customer Order Management product from 17.0 through 26.9. These are the only versions that are supported and susceptible to the flaw. The affected component is the Order Management module within the Siebel applications suite provided by Oracle Corporation.

The CVSS score of 6.5 indicates a moderate risk; however the vulnerability allows the attacker to influence data integrity and availability. The EPSS value is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting the risk of a publicly available exploit may be lower. The vulnerability is exploitable over a network via HTTP and requires low‑level privileges and user interaction, so attack feasibility is moderate but not trivial. It is not a remote code execution vector, but it does expose the application to unauthorized access and potential disruption. The scope change indicates that additional systems could also be affected if the malicious act propagates.