Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:44.247Z",
  "pubdate": "2026-08-18T21:17:44.247Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000. This security flaw introduces significant risk to enterprise environments by allowing unauthorized actors to compromise the integrity and confidentiality of sensitive master data management repositories. The vulnerability can be leveraged remotely over the network using standard HTTP protocol communications without requiring user interaction.\nFrom an attacker capability perspective, the vulnerability requires low privileges within the application domain, meaning an authenticated user with minimal authorization can initiate an attack. Successful exploitation yields severe consequences, granting unauthorized actors the ability to perform creation, deletion, and modification operations on critical enterprise data, alongside unrestricted read access to all accessible information within the Oracle Hyperion Data Relationship Management environment.\nThe CVSS 3.1 base score of 8.1 reflects the high severity associated with the confidentiality and integrity impacts, while availability remains unaffected. The risk implications are substantial, as compromised data integrity within a master data management platform can propagate erroneous reference data across downstream enterprise systems. Remediation efforts must focus on applying official vendor patches provided by Oracle for the affected version to address the underlying access control deficiencies.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from insufficient access control enforcement and authorization validation checks within the application's request handling logic. Specifically, when the system processes incoming HTTP requests, it fails to adequately verify whether a low-privileged authenticated user possesses the necessary administrative or operational permissions to execute sensitive data transactions.\nThe attack vector is network-based (AV:N), meaning the vulnerable service is exposed over network interfaces via the HTTP protocol. Exploitation complexity is low (AC:L), requiring no specialized reconnaissance, race conditions, or complex state manipulation beyond standard HTTP request generation. Furthermore, user interaction is not required (UI:N), allowing automated scripts or direct adversary interaction to successfully execute the attack payload. The attacker must authenticate to the application, fulfilling the low privilege requirement (PR:L), but subsequently bypasses logical boundaries intended to restrict access to sensitive functional areas and data repositories.\nThe step-by-step attack flow proceeds as follows: First, the low-privileged attacker establishes a network connection to the Oracle Hyperion Data Relationship Management endpoint utilizing HTTP. Second, the attacker authenticates using standard credentials associated with their low-privileged role. Third, the attacker crafts an unauthorized HTTP request targeting restricted functions within the Access and security component, attempting to invoke operations reserved for higher-privileged administrators, such as structural modifications or unauthorized data queries. Fourth, due to inadequate server-side authorization enforcement, the application processes the request and executes the requested actions against the database or internal data structures.\nThe post-exploitation impact spans both confidentiality (C:H) and integrity (I:H) vectors while leaving availability uncompromised (A:N). Regarding confidentiality, the adversary gains unauthorized read access to critical data and complete visibility over all accessible information within the Oracle Hyperion Data Relationship Management scope. Regarding integrity, the adversary achieves unauthorized creation, deletion, and modification capabilities, allowing them to corrupt, exfiltrate, or manipulate critical master data records. This compromises the trustworthiness of the entire data hierarchy managed by the application."
}