This vulnerability affects Oracle Hyperion Financial Reporting component Repository in version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function).

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Hyperion Financial Reporting. This compromises data confidentiality and integrity but does not affect system availability. The attacker does not require authentication and can exploit the vulnerability remotely over HTTP.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. Oracle emphasizes applying security patches without delay and remaining on actively-supported versions. No alternative mitigations or workarounds are specified in the advisory.