A local vulnerability in Oracle Communications Unified Inventory Management allows an attacker with low‑privilege access to a host that runs the product to compromise the application and read a subset of data that should be protected. The vulnerability leads to a confidentiality impact as specified by CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating that merely having a low‑privileged logon is sufficient for the exploit. The problem is due to insufficient authorization checks that permit reading data outside the intended authorized boundaries. No remote attack path is documented; the likely attack vector is local access to the infrastructure where the product executes.

Affected systems are Oracle Communications Unified Inventory Management versions 7.5.0 through 7.8.0 and 8.0.1. This includes the Oracle Communications product suite for managing inventory across communication infrastructures. Organizations running any of these releases are potentially impacted.

The CVSS base score of 3.3 classifies the vulnerability as low severity, but the exploitation is straightforward for a low‑privileged attacker who can log on to the host. The EPSS score is <1% (approximately 0.00112), indicating an extremely low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the attack requires only local logon, an attacker who compromises a user account or has physical access to the infrastructure could read confidential data at a low cost.