The BI Search component of Oracle Business Intelligence Enterprise Edition contains an unauthenticated HTTP access flaw that can be triggered without credentials. An attacker who gains network access can exploit this weakness to create, delete, or modify critical data within the BI system. The vulnerability stems from broken access control, absent authentication, and improper session handling (CWE-345). Successful exploitation also requires a user‑side interaction, typically through social engineering or a compromised trusted user.

Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 12.2.1.4.0 are affected; the issue is confined to the BI Search component in the enterprise editions of these products.

The CVSS 3.1 base score of 6.5 indicates a moderate integrity impact, and the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread attacks. Because the flaw allows unauthenticated HTTP access and hinges on user interaction, organizations with exposed BI endpoints or employees susceptible to phishing face a realistic threat of unauthorized data modification.