A vulnerability in the Strategic Sourcing component of PeopleSoft Enterprise SCM 9.2 permits an attacker who has only low privileges and network connectivity to HTTP endpoints to trigger the flaw and read any data exposed by the application. The bug is a low‑privilege access‑control bypass, allowing unauthorized users to view critical data that should be restricted, as denoted by the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H.

This issue affects Oracle PeopleSoft Enterprise SCM Strategic Sourcing version 9.2 and earlier releases that have not applied the available fix. Only the Strategic Sourcing module is involved; other PeopleSoft applications are not affected. Administrators should confirm that they are running the affected release and whether the patch has been applied.

With a CVSS base score of 6.5, the vulnerability presents a moderate risk. The EPSS score is not disclosed, but the ease of exploitation—requiring only network access and low privileges—could make it attractive to attackers. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Attackers would likely send malformed requests over an exposed HTTP interface to hijack access controls and extract data.