This vulnerability in Oracle Helidon 4.5.0 (component: Imperative Web Server) permits a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation results in unauthorized ability to update, insert, or delete some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity but not availability. The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but includes Helidon 4.5.0 in the list of affected versions for the August 2026 Critical Security Patch Update, implying patches are available.

The vulnerability allows unauthorized read and write access to some data accessible by Helidon 4.5.0, potentially compromising confidentiality and integrity of that data. There is no impact on availability. The attack requires network access and low privileges but no user interaction.

Oracle's August 2026 Critical Security Patch Update advisory includes Helidon 4.5.0 among affected versions and provides security patches. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. Patch status is not explicitly detailed for this CVE, so checking the vendor advisory and applying the latest Critical Security Patch Update is recommended.