The vulnerability resides in the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition. An attacker who has network access via HTTP and holds a low‑privileged account can exploit the flaw to read a subset of data otherwise protected within the system. This results in a confidentiality compromise. The weakness is an improper access control that permits unauthorized reads as reflected in the CVSS 3.1 vector with a base score of 4.3.

Affected are Oracle Corporation's Oracle Business Intelligence Enterprise Edition, specifically versions 8.2.0.0.0 and 26.01.0.0.0.

The CVSS score of 4.3 places the vulnerability in the moderate range, with a low compromise probability reflected by an existing advantage for attackers with network access but low privilege. EPSS score is < 1 % and the vulnerability is not listed in CISA KEV. The likely attack path is over HTTP without additional authentication requirements, indicating that the flaw is easily exploitable in environments where the interface is exposed.