Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T21:18:24.143Z",
  "pubdate": "2026-08-18T21:18:24.143Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 4.5.0. This security flaw enables a low-privileged threat actor with network access via the HTTP protocol to interact with the system and compromise targeted data resources. Successful exploitation of this vulnerability results in partial confidentiality and integrity impacts, granting unauthorized read, update, insert, or delete access to a subset of data accessible by Helidon. The attack vector is entirely network-based and requires low privileges, but does not necessitate user interaction. The overall risk implication involves unauthorized data manipulation and information disclosure, necessitating prompt remediation or mitigation actions for all deployments running the affected software version.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. The root cause stems from insufficient access controls or authorization validation mechanisms within the handling of HTTP requests processed by the web server framework. Because the flaw is exposed via network interfaces using the HTTP protocol, any remote actor possessing valid low-level credentials can interact with vulnerable endpoints. The attack flow begins when an authenticated, low-privileged attacker crafts and submits malicious HTTP requests targeting exposed application routes or APIs handled by the Imperative Web Server. Due to inadequate enforcement of authorization boundaries, the server processes these requests without adequately verifying whether the initiating user possesses the requisite privileges to read, update, insert, or delete the targeted data objects. Upon successful payload execution, the application processes the unauthorized data transactions, resulting in the exposure of sensitive information (Confidentiality impact) and unauthorized modification or destruction of application data (Integrity impact). The vulnerability does not affect system availability, as indicated by the CVSS 3.1 metrics (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning denial-of-service conditions are not typically induced through this specific vector. Exploitation requirements are minimal, relying solely on network connectivity, standard HTTP protocol mechanics, and low-privilege authentication credentials. Post-exploitation impact is strictly bound to the data accessible within the operational context of the Helidon application runtime environment."
}