Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:43.867Z",
  "pubdate": "2026-08-18T21:17:43.867Z",
  "executiveSummary": "A vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000.\nThis security flaw is classified as a difficult-to-exploit vulnerability that can be leveraged by a low-privileged attacker with network access via the HTTP protocol.\nSuccessful exploitation of this vulnerability compromises the target application, resulting in a complete takeover of Oracle Hyperion Data Relationship Management.\nThe associated CVSS 3.1 base score is 7.5, indicating high severity impacts across confidentiality, integrity, and availability.\nThe attack vector is network-based (AV:N), with high attack complexity (AC:H), requiring low privileges (PR:L), and no user interaction (UI:N) within an unchanged security scope (S:U).\nOrganizations utilizing the affected version face significant risk of unauthorized system manipulation and data exposure due to the potential for total application compromise.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000.\nNetwork exposure via HTTP allows an authenticated attacker with low privileges to interact directly with vulnerable endpoints handling access control and security management.\nAlthough exploitation requires high attack complexity, successful execution allows an attacker to bypass intended security boundaries within the access and security subsystem.\nThe attack flow begins with the low-privileged attacker establishing network connectivity to the Oracle Hyperion Data Relationship Management instance via HTTP.\nBy leveraging specific conditions inherent to the high attack complexity vector, the attacker submits crafted requests designed to exploit flaws in how the Access and security component processes authorization or state management.\nUpon successful processing of the malicious payload, the application fails to adequately validate or enforce security constraints, allowing the attacker to escalate privileges or execute unauthorized administrative functions.\nPost-exploitation impact includes the total takeover of Oracle Hyperion Data Relationship Management, granting the attacker complete control over application functionality and underlying data.\nThe compromise results in severe impacts on confidentiality, integrity, and availability, exposing sensitive master data and administrative controls to unauthorized entities."
}