Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:45.207Z",
  "pubdate": "2026-08-18T21:17:45.207Z",
  "executiveSummary": "A security vulnerability has been identified within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This remotely exploitable flaw poses severe risks to enterprise environments utilizing the affected software. The vulnerability allows a low-privileged authenticated attacker with network access via the HTTP protocol to execute unauthorized actions leading to a complete system compromise.\nSuccessful exploitation of this flaw grants the adversary the ability to achieve a full takeover of Oracle Hyperion Data Relationship Management. The impact encompasses complete compromise of confidentiality, integrity, and availability, meaning an attacker can access sensitive master data, manipulate hierarchical structures, and disrupt core business operations. With a CVSS 3.1 Base Score of 8.8, the severity is categorized as high.\nThe attack vector is network-based, requiring low privileges and no user interaction, making it particularly dangerous if internal network perimeters are breached or if the application is improperly exposed. Remediation requires applying official vendor patches provided by Oracle to secure the access and security control mechanisms.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.25.0.000. The root cause stems from insufficient authorization checks and improper access control enforcement within the application's request handling pipeline, allowing low-privileged principals to invoke administrative or privileged functions over the HTTP protocol.\nExploitation of this vulnerability requires the attacker to possess valid low-privileged credentials and network access to the HTTP interface of Oracle Hyperion Data Relationship Management. The attack flow begins with the malicious actor authenticating to the application with standard user privileges. The attacker then crafts and transmits specially manipulated HTTP requests targeted at vulnerable endpoints within the Access and security subsystem.\nBecause the underlying component fails to adequately validate whether the authenticated user possesses the requisite administrative roles or authorization context for the requested operations, the application processes the malicious payload. This bypass of security controls permits the execution of privileged functions that are normally restricted to high-privileged administrators.\nFollowing successful request processing, the post-exploitation impact includes the complete takeover of Oracle Hyperion Data Relationship Management. An attacker can leverage this unauthorized administrative capability to modify security configurations, create arbitrary privileged accounts, extract sensitive master data repositories, tamper with critical organizational hierarchies, and cause denial of service by disabling core service routines or modifying system parameters."
}