This vulnerability in Oracle Hyperion Data Relationship Management (version 11.2.25.0.000) involves a flaw in the access and security component that can be exploited remotely over HTTP by an unauthenticated attacker. Successful exploitation leads to unauthorized access to critical or complete data within the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. The vulnerability is identified as CWE-284 (Improper Access Control).

Exploitation of this vulnerability can result in unauthorized disclosure of sensitive data managed by Oracle Hyperion Data Relationship Management. There is no indication of impact on data integrity or availability. The vulnerability does not require authentication, making it easily exploitable by remote attackers with network access via HTTP.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. No alternative mitigations or workarounds are specified by Oracle. Staying on actively supported versions and applying security patches without delay is recommended.