CVE-2026-46830
Oracle REST Data Services Unauthorized Data Access
Publication date: 2026-05-28
Last updated on: 2026-05-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | rest_data_services | From 24.2.0 (inc) to 26.1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Oracle REST Data Services, specifically in the Mongoapi component, affecting versions 24.2.0 through 26.1.0.
It is easily exploitable by an unauthenticated attacker who has network access via HTTPS.
Successful exploitation allows the attacker to gain unauthorized read access to some of the data accessible through Oracle REST Data Services.
How can this vulnerability impact me? :
The impact of this vulnerability is unauthorized disclosure of data.
An attacker can read a subset of data from Oracle REST Data Services without authentication, potentially exposing sensitive information.
There is no impact on integrity or availability according to the CVSS score.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access via HTTPS to gain unauthorized read access to a subset of data accessible through Oracle REST Data Services. Such unauthorized data exposure could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate strict controls over unauthorized access to personal and sensitive information.
However, the provided information does not specify the exact nature of the data exposed or the regulatory impact, so the precise compliance implications cannot be determined from the given context.