Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T21:18:20.503Z",
  "pubdate": "2026-08-18T21:18:20.503Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This security flaw allows a low-privileged remote attacker with network access via HTTP to compromise the affected Helidon deployment.\nSuccessful exploitation of this vulnerability results in partial confidentiality and integrity impacts, granting unauthorized read access to a subset of Helidon-accessible data, alongside unauthorized update, insert, or delete access to specific resources.\nThe vulnerability requires low privileges and network accessibility, making it accessible to authenticated users operating within the network boundary of the HTTP service. The absence of required user interaction lowers the operational friction for an attacker attempting to compromise data integrity and confidentiality.\nThe risk implications involve unauthorized data manipulation and information disclosure within enterprise environments relying on vulnerable Helidon instances, necessitating immediate remediation or version migration to secure affected architectures.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Helidon product within Oracle Fusion Middleware, specifically affecting version 4.5.0. The root cause stems from insufficient access control enforcement or improper request validation handling within the web server architecture, which fails to adequately restrict operations performed by low-privileged entities.\nExploitation is conducted remotely over the network utilizing standard HTTP protocols. An attacker initiates the attack flow by authenticating with low-level privileges and transmitting crafted HTTP requests targeting the Imperative Web Server. Because the underlying routing or authorization logic does not properly validate whether the authenticated low-privileged user possesses the requisite permissions for the requested data modification or retrieval operations, the server processes the payload.\nThe attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L), and no user interaction (UI:N) under the CVSS 3.1 framework. The scope remains unchanged (S:U). The payload behavior involves issuing unauthorized HTTP methods or accessing restricted endpoint paths that bypass intended authorization boundaries.\nUpon successful processing of the malicious HTTP requests, the post-exploitation impact compromises the CIA triad by permitting unauthorized read access to sensitive subsets of data (C:L) and unauthorized update, insert, or delete actions against accessible data repositories (I:L). Availability remains unaffected (A:N), resulting in a CVSS 3.1 Base Score of 5.4."
}