Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T21:18:05.400Z",
  "pubdate": "2026-08-18T21:18:05.400Z",
  "executiveSummary": "A vulnerability has been identified within the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics, specifically within the BI Search component. This security flaw allows a low-privileged threat actor with network access to execute attacks via the HTTP protocol, leading to a significant scope change that can impact additional products beyond the immediate application boundary. The vulnerability is characterized by a high impact on confidentiality, enabling unauthorized access to critical data or complete access to all data accessible within Oracle Business Intelligence Enterprise Edition. The exploitation vector is network-based with low attack complexity, requiring low privileges but no user interaction. According to the CVSS 3.1 scoring system, the vulnerability receives a Base Score of 7.7, reflecting severe confidentiality implications. Organizations utilizing affected versions are exposed to severe data compromise risks if appropriate patches and security controls are not promptly implemented.",
  "technicalDetails": "The vulnerability resides in the BI Search component of Oracle Business Intelligence Enterprise Edition, affecting explicitly supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The root cause stems from insufficient validation, authorization enforcement, or improper handling of search queries and data retrieval requests processed by the BI Search functionality. This allows authenticated users with low privileges to bypass logical security boundaries and access restricted datasets.\nThe exploitation vector requires the attacker to have network access to the target environment via HTTP. Since the vulnerability possesses a low attack complexity and requires no user interaction, an attacker with valid low-privileged credentials can directly interact with the vulnerable HTTP endpoints associated with the BI Search component. By issuing specially crafted search requests or manipulating query parameters, the attacker can force the backend application to return sensitive data that exceeds their authorized permission level.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the vulnerable Oracle Business Intelligence Enterprise Edition server targeting the BI Search component. Second, the attacker formulates an arbitrary or out-of-bounds search query designed to access protected data repositories or indices normally restricted to higher-privileged roles or administrators. Third, the BI Search component processes the request without adequately verifying the caller's authorization context against the requested data objects. Finally, the application returns the sensitive query results to the attacker.\nDue to the scope change (S:C) characteristic of this vulnerability, the impact extends beyond the immediate Oracle Business Intelligence Enterprise Edition application context, potentially affecting integrated or interconnected products. The post-exploitation impact is exclusively focused on confidentiality (C:H), resulting in unauthorized retrieval of critical data or comprehensive exposure of all accessible datasets within the system, without direct integrity or availability disruption."
}