CVE-2026-34323
Authentication Bypass in Oracle Life Sciences InForm Allows Data Manipulation
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | life_sciences_inform | 7.0.1.0 |
| oracle | life_sciences_inform | 7.0.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized read, update, insert, or delete access to some data within Oracle Life Sciences InForm, as well as the ability to cause a partial denial of service. Such unauthorized access and potential data manipulation could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.
Specifically, unauthorized access to sensitive data may violate confidentiality requirements, while unauthorized modifications could impact data integrity. Additionally, denial of service could affect availability obligations under these standards.
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Life Sciences InForm product, specifically in the IDM Authentication component for versions 7.0.1.0 and 7.0.1.1.
It allows an unauthenticated attacker with network access via HTTP to compromise the system. However, successful exploitation requires human interaction from someone other than the attacker.
If exploited, the attacker can gain unauthorized abilities such as updating, inserting, or deleting some accessible data, reading a subset of accessible data, and causing a partial denial of service (partial DOS) on the Oracle Life Sciences InForm system.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to perform unauthorized actions on your Oracle Life Sciences InForm data.
- Unauthorized update, insert, or delete access to some accessible data.
- Unauthorized read access to a subset of accessible data.
- Ability to cause a partial denial of service (partial DOS) affecting availability of the system.