A flaw in Oracle PeopleSoft Enterprise FIN Common Objects Brazil allows any network user to send HTTP requests that enable unauthorized changes to data and may induce a partial denial of service. The vulnerability arises from insufficient access controls that permit update, insert, or delete actions without authentication. An attacker can therefore alter critical business data or disrupt availability in a limited fashion, compromising data integrity and availability but not confidentiality. The weakness corresponds to improper access control.

Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is affected. The product is part of the PeopleSoft Enterprise FIN Common Objects Brazil suite; the affected build is version 9.1 as identified by the vendor’s product name and CPE string.

The vulnerability is remote and exploitable over HTTP by unauthenticated users, implying a high attack potential. The CVSS 3.1 score of 6.5 indicates moderate severity. Since no EPSS data is available, the exact exploitation probability is unknown, and the issue is not listed in the CISA KEV catalog, but the exposed network interface and broad impact warrant attention. Attackers would prepare a crafted HTTP request to modify data or trigger partial service interruption, thereby compromising system integrity and availability.