Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:43.487Z",
  "pubdate": "2026-08-18T21:17:43.487Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000.\nThis vulnerability allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the affected system without requiring any user interaction.\nSuccessful exploitation of this security flaw can lead to severe impacts on data integrity and confidentiality, resulting in unauthorized creation, deletion, modification, or complete access to critical data managed within the Oracle Hyperion Data Relationship Management environment.\nThe severity of this flaw is reflected by a CVSS 3.1 Base Score of 9.1, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.\nThe risk implications are critical for organizations utilizing the affected version, as unauthorized external entities can subvert access controls over sensitive enterprise master data.\nAttackers require no prior privileges or authentication credentials, lowering the barrier to entry for malicious actors targeting exposed instances over the network.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000, specifically within the mechanisms responsible for enforcing access controls and request validation.\nThe root cause stems from improper authorization enforcement, allowing incoming HTTP requests to bypass security boundaries and execute privileged operations without validating the identity or permission set of the caller.\nAttackers exploit this flaw by leveraging network access via the HTTP protocol to interact directly with vulnerable endpoints exposed by the Access and security component.\nBecause the attack vector is network-based (AV:N) with low attack complexity (AC:L), an adversary does not need specialized local access or complex preconditions.\nFurthermore, the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), enabling automated scripts or unauthenticated threat actors to issue direct malicious payloads to the target server.\nDuring the attack flow, the adversary crafts malicious HTTP requests targeting the insecurely guarded functional components of the application.\nUpon receipt, the vulnerable component fails to properly authenticate the session or verify authorization tokens, incorrectly processing the request as legitimate.\nThis permits the unauthorized execution of data manipulation commands and retrieval routines.\nThe post-exploitation impact spans both the confidentiality and integrity security dimensions (C:H, I:H), while availability remains unaffected (A:N).\nConsequently, malicious actors can perform unauthorized creation, deletion, or modification of critical master data records, as well as exfiltrate sensitive organizational datasets accessible through Oracle Hyperion Data Relationship Management."
}