Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T21:18:19.693Z",
  "pubdate": "2026-08-18T21:18:19.693Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This security flaw enables a low-privileged threat actor with network access via the HTTP protocol to compromise the affected Helidon deployment.\nSuccessful exploitation of this vulnerability compromises data confidentiality and integrity by granting unauthorized read access to a subset of Helidon-accessible data, alongside unauthorized update, insert, or delete capabilities against targeted data stores.\nThe vulnerability carries a CVSS 3.1 Base Score of 5.4 with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The attack vector is network-based, requires low privileges, and does not require user interaction, posing a moderate risk to organizational data assets managed by the vulnerable framework.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Oracle Fusion Middleware Helidon framework, specifically affecting version 4.5.0. The root cause stems from insufficient access controls and authorization enforcement within the request processing lifecycle of the HTTP server implementation.\nAn attacker initiates the attack flow by leveraging network access via the HTTP protocol to interact directly with the vulnerable Helidon endpoint. Because the vulnerability requires low privileges, the attacker must first authenticate against the system to obtain valid session credentials or authorization tokens.\nUpon authentication, the attacker crafts malicious HTTP requests containing payloads designed to bypass intended boundary checks. Due to the lack of proper authorization validation within the Imperative Web Server component, the application processes the requests and fails to restrict data access according to the user's assigned privilege level.\nPost-exploitation impact includes unauthorized read access to sensitive subsets of Helidon-accessible data, as well as unauthorized data manipulation manifested through update, insert, and delete operations. The scope remains unchanged (S:U), and availability is not impacted (A:N), indicating that the flaw is strictly confined to data integrity and confidentiality breaches rather than denial of service conditions."
}