The vulnerability is an access control flaw located in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process. A low privileged attacker who can reach the system over HTTP can bypass authorization checks. The attacker can read confidential data, insert, update, or delete records, and trigger a partial denial of service, thereby compromising the confidentiality, integrity, and availability of the application.

Oracle Agile Product Lifecycle Management for Process, version 6.2.4, is the only system specifically listed as affected. Systems running earlier or later minor releases are not mentioned as vulnerable in the data provided.

The CVSS v3.1 base score of 6.4 indicates a medium severity issue, with an attacker needing network access via HTTP and only a low privileged account to succeed. The vulnerability is described as difficult to exploit, suggesting a lower likelihood of attack, yet the impact would be significant if achieved. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, implying that it has not yet been widely reported or exploited. Nevertheless, the combination of low privilege, network reachability, and the nature of the potential impact warrants prompt remediation.