Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:17:45.330Z",
  "pubdate": "2026-08-18T21:17:45.330Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000. This network-based security flaw allows unauthenticated attackers interacting via the HTTP protocol to compromise the targeted system without requiring user interaction.\nSuccessful exploitation of this vulnerability has severe risk implications for enterprise data integrity and confidentiality. An attacker can achieve unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. Furthermore, the vulnerability permits unauthorized update, insert, or delete access to a subset of the accessible data within the application.\nGiven the network vector and the absence of authentication or user interaction requirements, the vulnerability presents a significant risk profile, reflected in a CVSS 3.1 Base Score of 8.2 with high confidentiality and low integrity impacts.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from insufficient access controls and inadequate validation of incoming HTTP requests processed by the application layer.\nThe attack vector is network-based (AV:N), allowing remote adversaries to interact directly with the vulnerable HTTP endpoints exposed by the service. The attack complexity is low (AC:L), requiring no specialized configuration or race conditions to successfully execute malicious payloads. Crucially, the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), meaning an unauthenticated external actor can initiate exploitation directly.\nDuring the attack flow, the adversary crafts malicious HTTP requests designed to bypass the access and security enforcement mechanisms of the vulnerable component. Because the application fails to properly authenticate and authorize incoming connections to sensitive modules, the processing engine accepts the malicious payload.\nUpon successful parsing and execution of the unauthorized request, the post-exploitation impact allows the attacker to read highly sensitive master data and metadata stored within the Oracle Hyperion Data Relationship Management repository, fulfilling the high confidentiality impact metric. Additionally, the attacker can execute unauthorized insert, update, or delete operations against vulnerable data segments, compromising data integrity."
}