Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:45.693Z",
  "pubdate": "2026-08-18T21:17:45.693Z",
  "executiveSummary": "An unauthorized data access vulnerability affects the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This security flaw allows unauthenticated remote attackers with network access via the HTTP protocol to compromise the confidentiality of the affected product without requiring user interaction.\nSuccessful exploitation of this vulnerability grants unauthorized attackers complete or critical access to sensitive data stored and managed within Oracle Hyperion Data Relationship Management. The vulnerability carries a CVSS 3.1 Base Score of 7.5, reflecting a high severity impact strictly limited to data confidentiality with no direct integrity or availability impacts.\nThe risk implication is significant for organizations utilizing the vulnerable platform, as malicious actors can harvest proprietary master data, metadata, and hierarchical relationships directly through network interfaces. Exploitation requirements are minimal, requiring only network reachability to the vulnerable HTTP service and no prior privileges or credentials.\nMitigation requires applying vendor-supplied updates or implementing strict network segmentation and access controls to restrict unauthorized HTTP requests targeting the vulnerable Access and security component.",
  "technicalDetails": "The vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from improper authorization enforcement or a lack of authentication checks within the HTTP request handling routines of the affected subsystem, enabling external entities to bypass security boundaries.\nThe attack vector is network-based (AV:N), allowing remote adversaries to interact directly with the application over standard HTTP protocols without traversing local network perimeters. Attack complexity is rated as low (AC:L), indicating that the targeted endpoints lack robust defensive mechanisms against automated enumeration or direct payload delivery.\nNo privileges are required (PR:N) and no user interaction (UI:N) is necessary, establishing a zero-friction exploitation vector where a malicious actor can directly issue crafted HTTP requests to the vulnerable interface. The scope remains unchanged (S:U), as the vulnerability is contained within the application domain.\nDuring the attack flow, an unauthenticated client initiates an HTTP connection to the exposed Oracle Hyperion Data Relationship Management service. By targeting specific URIs or parameters associated with the Access and security component, the attacker bypasses session validation and access control logic. The application processes the request and improperly returns restricted master data structures, hierarchies, and sensitive enterprise metadata in the HTTP response.\nThe post-exploitation impact is characterized by a high confidentiality breach (C:H). Attackers can systematically exfiltrate critical enterprise datasets, organizational hierarchies, and relationship management configurations, potentially leading to corporate espionage or downstream supply chain compromises. Integrity (I:N) and availability (A:N) metrics remain unaffected, as the vulnerability does not facilitate unauthorized data modification or denial of service conditions."
}