Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T21:18:23.907Z",
  "pubdate": "2026-08-18T21:18:23.907Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0, presenting significant risks to enterprise data security and application integrity.\nThe vulnerability enables a low-privileged authenticated attacker with network access via the HTTP protocol to compromise the affected Helidon instance, leading to unauthorized data manipulation and disclosure.\nSuccessful exploitation results in unauthorized read, update, insert, and delete access to a subset of data accessible by Helidon, while maintaining system availability without causing denial of service.\nThe attack vector is network-based with low attack complexity, requiring low privileges but no user interaction, resulting in a CVSS 3.1 Base Score of 5.4 with impacts restricted to confidentiality and integrity.\nOrganizations deploying the affected Oracle Fusion Middleware Helidon product face potential exposure of sensitive application data and unauthorized state modification if proper access controls and mitigations are not promptly applied.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0, specifically impacting request handling and authorization mechanisms for accessible data subsets.\nThe root cause stems from insufficient validation or enforcement of access control lists and authorization checks within the HTTP request processing pipeline of the vulnerable component, allowing authenticated sessions with low privileges to bypass intended security boundaries.\nThe attack vector is exclusively network-based (AV:N), allowing remote exploitation over standard HTTP protocols without requiring physical or local access to the underlying host infrastructure.\nThe attack complexity is low (AC:L), indicating that the target lacks robust defensive countermeasures against this specific validation bypass or that exploitation conditions are reliably reproducible by an adversary.\nPrerequisites for a successful attack include low privileges (PR:L), meaning the malicious actor must authenticate to the Helidon application with standard user credentials before initiating the exploit payload.\nThe interaction requirement is none (UI:N), allowing automated or manual exploitation scripts to be executed directly against the targeted HTTP endpoint without requiring human user intervention.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes a standard HTTP connection to the exposed Helidon Imperative Web Server endpoint. Second, the attacker crafts malicious HTTP requests targeting resources or data subsets normally restricted by authorization policies. Third, due to the flaw in the Imperative Web Server component, the application fails to adequately enforce authorization checks for the requested operations. Finally, the server processes the payload, granting unauthorized read access to confidential data or executing unauthorized update, insert, and delete operations against the targeted data subsets.\nThe post-exploitation impact is constrained to the confidentiality (C:L) and integrity (I:L) security dimensions within the scope of the local application context (S:U), with availability remaining unaffected (A:N)."
}