A weakness in the Web Server component of Oracle BI Publisher permits an unauthenticated attacker with HTTP network access to perform unauthorized update, insert, delete, and read operations on data exposed through the application. The intrusion does not require the attacker’s own credentials; however, it must be triggered by interaction with a different person who has a valid client session. The flaw compromises the confidentiality and integrity of the affected data but has no direct impact on availability.

Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 are affected. The vulnerability applies to installations that expose the BI Publisher Web Server interface to the network. All users of these releases should verify whether their deployments are reachable from external networks and consider limiting exposure until remediation is applied.

The CVSS v3.1 base score of 6.1 indicates a moderate severity. The attack vector is network‑based, with low complexity and no required attacker‑controlled authentication, but it requires user interaction to finalize the exploit. The EPSS score is reported as < 1%, implying a very low but nonzero exploitation probability. The vulnerability is not catalogued in the CISA KEV list. Although exploitation demands a coordinated action with a human user, the potential for unauthorized data modification and disclosure renders this a significant risk that warrants prompt attention.