Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:47.237Z",
  "pubdate": "2026-08-18T21:17:47.237Z",
  "executiveSummary": "An unauthenticated, network-accessible vulnerability exists within the Access and Security component of the Oracle Hyperion Data Relationship Management (DRM) product, specifically impacting version 11.2.25.0.000. This vulnerability allows remote attackers with network access via the HTTP protocol to compromise the affected system without requiring credentials or user interaction.\nSuccessful exploitation of this flaw grants the adversary unauthorized access to critical data or complete access to all data accessible within the Oracle Hyperion Data Relationship Management application. The primary risk implication centers on severe confidentiality breaches, as unauthorized entities can harvest sensitive master data and organizational hierarchies managed within the DRM repository.\nThe vulnerability is characterized by a CVSS 3.1 Base Score of 7.5 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that network attack vector (AV:N), low attack complexity (AC:L), lack of required privileges (PR:N), and zero user interaction (UI:N) make this flaw trivial to target for threat actors possessing network visibility to the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides in the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. Specifically, the flaw stems from improper access control enforcement within the application's HTTP request handling mechanisms, allowing remote clients to bypass authentication and authorization boundaries designed to protect sensitive master data domains.\nThe attack vector is exclusively network-based, leveraging standard HTTP protocols utilized by the Oracle Hyperion Data Relationship Management web interface or associated web services. Because the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), an unauthenticated attacker can directly construct and transmit arbitrary HTTP requests to target endpoints without establishing a valid session or performing prior reconnaissance against user accounts.\nThe exploitation flow begins with the attacker identifying the exposed Oracle Hyperion Data Relationship Management service listening over HTTP via the network. The attacker then crafts specific HTTP requests targeting vulnerable endpoints within the Access and Security component. Due to inadequate input validation, session validation, or role-based access control checks in the affected version, the application fails to verify whether the incoming request originates from an authenticated and authorized user.\nUpon processing the malicious HTTP request, the vulnerable component improperly discloses restricted application data. The payload behavior does not involve code execution or denial-of-service conditions, as indicated by the CVSS metrics (I:N, A:N), but instead focuses strictly on unauthorized information disclosure (C:H). The post-exploitation impact allows the adversary to continuously query, extract, and exfiltrate critical business data, metadata, and hierarchical relationships stored within the Oracle Hyperion Data Relationship Management database, leading to a total compromise of data confidentiality."
}