The vulnerability is exposed through the Web Service API of Oracle BI Publisher, allowing a low‑privileged attacker with network access over HTTP to gain unauthorized update, insert or delete access to some data and to read a subset of data. The vulnerability is exploitable in supported versions 8.2.0.0.0 and 26.01.0.0.0 and requires human interaction from a user other than the attacker, indicating that social engineering or click‑through mechanisms could trigger the exploitation. The impact is limited to confidentiality and integrity of the data exposed via the service, and the vulnerability classification lists a medium base score of 5.4 as calculated by CVSS 3.1.

The affected systems are Oracle BI Publisher from Oracle Corporation. Specifically, versions 8.2.0.0.0 and 26.01.0.0.0 are vulnerable to the Web Service API weakness.

With a CVSS 3.1 base score of 5.4, the vulnerability poses a moderate threat level. The exploitation path requires network access to the Web Service API over HTTP and a low‑privileged attacker with the ability to coerce another user to interact with the service, making it easier to acquire a successful attack. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability does not appear in the CISA KEV catalog, but the scope change in the CVSS vector suggests potential exposure to other components in Oracle Analytics. Overall, the risk is moderate, necessitating a review of access controls, patching status, and monitoring for anomalous API usage.