The reported flaw resides in the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil. An unauthenticated attacker with network access to the HTTP interface can trigger code that returns a subset of institutional data without requiring any credentials. This leads to a confidentiality breach, allowing the attacker to read information intended for users only. The flaw exemplifies a missing authorization check (CWE-306).

Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1, specifically the eProcurement module. The CPE entry confirms that only the 9.1 release is impacted and no other versions are affected per the vendor’s statement.

The CVSS 3.1 base score of 5.3 reflects a low‑to‑moderate risk, with limited impact on integrity and availability. The attack vector is over standard HTTP and does not require higher privileges or user interaction. Although the EPSS score of < 1% indicates a very low exploitation probability, the vulnerability is not listed in the CISA KEV catalog, a remote attacker can still exploit the flaw to gain unauthorized read access to sensitive data. Continuous monitoring is advised because the vulnerability is exploitable without authentication.