Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:45.570Z",
  "pubdate": "2026-08-18T21:17:45.570Z",
  "executiveSummary": "A vulnerability has been identified in the Oracle Hyperion Data Relationship Management product, specifically within the Access and security component, affecting version 11.2.25.0.000. This security flaw represents an access control or authorization bypass vulnerability that leads to severe confidentiality impacts.\nThe vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the affected Oracle Hyperion Data Relationship Management system without requiring user interaction or prior privileges. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by the Oracle Hyperion Data Relationship Management application.\nGiven the network vector and the lack of authentication or interaction requirements, the vulnerability carries a CVSS 3.1 Base Score of 7.5, reflecting a high risk to data confidentiality. Organizations utilizing the affected version face significant exposure to data exfiltration and privacy breaches, necessitating immediate defensive measures to secure the exposed access and security component.",
  "technicalDetails": "The vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from insufficient authentication enforcement or flawed authorization checks within the HTTP request handling routines managed by the component. Consequently, the application fails to adequately validate whether incoming HTTP requests originate from authenticated and authorized principals before serving sensitive data.\nExploitation of this vulnerability is network-based, leveraging the HTTP protocol to interact directly with the vulnerable endpoints exposed by Oracle Hyperion Data Relationship Management. An attacker requires no privileges (PR:N) and no user interaction (UI:N) to initiate the attack. The attack vector is strictly network-accessible (AV:N), meaning any system capable of routing HTTP traffic to the target application can execute the exploit payload.\nThe attack flow proceeds as follows: First, the unauthenticated attacker probes the network perimeter to identify the exposed Oracle Hyperion Data Relationship Management HTTP service endpoints associated with the Access and security component. Second, the attacker crafts a specialized HTTP request designed to bypass the intended security controls. Because the component incorrectly handles authentication validation or access restriction enforcement, the application processes the request as if it were legitimate.\nUpon successful processing, the application returns the requested data payloads within the HTTP response stream. The post-exploitation impact is strictly bounded to confidentiality degradation, yielding unauthorized read access to critical enterprise master data, hierarchical structures, and sensitive relational records stored or managed within the Oracle Hyperion Data Relationship Management repository. The vulnerability does not natively provide integrity or availability modification capabilities, as indicated by the CVSS metric components (I:N/A:N), but the complete exposure of managed data poses severe enterprise risks."
}