Oracle BI Publisher contains a flaw that permits unauthenticated HTTP access to its Web Server component, allowing an attacker to read any data exposed by the application. The vulnerability is a missing authentication check and inadequate access control (CWE-200). Successful exploitation restores full visibility of confidential information stored or displayed by the BI Publisher instance. The CVSS 3.1 base score of 7.5 highlights the high impact to confidentiality with no privilege requirement.

The flaw affects Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, as stated by Oracle. These products run within Oracle Analytics and expose their Web Server component to network traffic.

The CVSS score of 7.5 combined with an EPSS score of less than 1% indicates moderate‑to‑high likelihood of exploitation when network access to the HTTP interface is available. Because the weakness does not require authentication, any host that can reach the publisher’s web server can potentially read all exposed data, making the attack path simple for adversaries on untrusted networks. Though not listed in CISA’s KEV catalog, the vulnerability remains critical due to its broad availability and the severity of potential data exposure.