A flaw in the GraphQL component of Oracle REST Data Services allows an attacker to obtain sensitive or all data exposed by the service. The vulnerability results in a breach of confidentiality, and can lead to the acquisition of critical business information. The impact is limited to data accessed through the compromised service but could represent a significant loss of privacy or competitive advantage.

Oracle REST Data Services versions 24.2.0 through 26.2.1 are affected. This applies to installations deployed by Oracle Corporation under the Oracle REST Data Services product line.

The CVSS v3.1 score of 6.5 reflects a medium severity with high confidentiality impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a lack of documented widespread exploitation. The likely attack vector is a low‑privileged adversary connecting over HTTP to the exposed GraphQL endpoint, making the vulnerability relatively easy to exploit in a networked environment.