This vulnerability resides in the Security component of Oracle Essbase and allows an attacker with low privilege and network reach via HTTP to read a subset of data that should be protected. The flaw does not grant full system control or disrupt availability; instead it exposes confidential information to unauthorized users, limiting the impact to a read‑only data breach that can be leveraged for competitive advantage.

Oracle Essbase version 21.8.3.0.0 is affected. The issue is documented for this exact build and may threaten any systems running this release.

The CVSS 3.1 base score of 5.0 classifies the vulnerability as medium severity, focusing on confidentiality loss. The EPSS score is <1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet been observed. The likely attack vector is a network boundary attacker who can reach the Essbase HTTP interface; the breach requires low privilege, and success may also affect other products that integrate with Essbase due to a scope change.