A vulnerability in Oracle BI Publisher allows an attacker with low privileges and network access through HTTP to tamper with data—performing unauthorized updates, inserts, or deletions—and to read restricted data sets. The flaw permits both integrity and confidentiality violations without requiring user interaction, as indicated by the CVSS vector. No mention of denial of service or code execution is provided.

Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 are impacted. The issue resides in the BI Publisher Security component and can be exploited when the application is exposed to the network.

The CVSS base score of 5.4 indicates moderate impact, primarily on confidentiality and integrity. The EPSS score is not available, but the vulnerability is considered easily exploitable through normal HTTP traffic to the application. It is not listed in the CISA KEV catalog, so there is no current evidence of widespread exploitation. Given the network-based attack vector and the requirement for only low-level privileges, the risk to environments that expose BI Publisher to untrusted networks is significant.