The flaw resides in the Bidder Registration component of Oracle PeopleSoft Enterprise SCM Strategic Sourcing. An attacker with basic network access can send a crafted HTTP request to the exposed endpoints. Because the application fails to enforce adequate authorization, the attacker can read or retrieve sensitive procurement data. The CVSS vector indicates a high confidentiality impact and a medium overall severity, meaning that while execution does not compromise integrity or availability, it can expose protected information to unauthorized users. The likely attack vector is HTTP from a low‑privileged network user, inferred from the description’s mention of network access via HTTP and the low‑privilege requirement.

Only the 9.2 release of PeopleSoft Enterprise SCM Strategic Sourcing is known to be affected. No other versions or components are currently documented as vulnerable.

The CVSS base score of 6.5 positions the vulnerability in the medium range, suggesting that every affected installation should be examined for exposure. The lack of an EPSS score and the absence of a KEV listing imply that large‑scale exploitation has not yet been observed. The readily available network entry point and the low privilege requirement mean that a determined attacker could accomplish the exploit without elevated credentials. The assessment that the vulnerability is exploitable is inferred from the exposed HTTP interface and the stated low‑privilege condition.