Oracle Essbase version 21.8.3.0.0 contains a weakness in its Security component that permits a low‑privileged attacker with network access via HTTP to read a subset of database information. The flaw does not affect integrity or availability but results in a confidentiality compromise, allowing sensitive data to be disclosed to unauthenticated or minimally privileged users. The vulnerability is an information‑exposure flaw and is rated with a CVSS 3.1 base score of 4.3.

The affected systems are Oracle Corporation’s Essbase product running version 21.8.3.0.0. No other vendors or product families are currently identified as impacted.

The likely attack vector is a direct HTTP request to the Essbase server, requiring only local network connectivity and minimal privileges. With a CVSS score of 4.3, an EPSS score of <1%, and no KEV listing, the exploitation probability is low, but the potential data leakage warrants vigilance. Organizations that store valuable or regulated information in Essbase should consider this risk significant enough to prompt timely remediation.