EUVD-2026-46454
GHSA-7r8c-4mc8-chwj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible HTTP endpoint with low-privilege requirement; impact is read-only, limited confidentiality, no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is affected is 21.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthorized data disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows a network-based, low-privileged attacker to read a subset of application data via the Xstore Mobile component over HTTP. Tagged as an Authentication Bypass, the flaw suggests a low-privileged authenticated session can exceed its authorized data access scope without elevated rights. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate, bounded confidentiality risk.
Technical ContextAI
Oracle Retail Xstore Point of Service is an enterprise POS (Point of Sale) platform used by retail organizations; the affected component is Xstore Mobile, the HTTP-based mobile interface layer of the platform. The exact affected version is 21.0.3 (CPE: cpe:2.3:a:oracle_corporation:oracle_retail_xstore_point_of_service:*:*:*:*:*:*:*:*). The tag 'Authentication Bypass' indicates that the root cause class involves improper authorization or access control enforcement - likely an insecure direct object reference, missing authorization check on a mobile API endpoint, or privilege escalation within the session. No CWE has been formally assigned, but the behavioral profile maps closely to CWE-285 (Improper Authorization) or CWE-639 (Authorization Bypass Through User-Controlled Key). The attack vector is HTTP, meaning the Xstore Mobile API surface is the entry point.
RemediationAI
The primary remediation is to apply Oracle's Critical Patch Update (CPU) for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond 21.0.3 is not independently confirmed from the available data - consult the CPU advisory for the precise target release. Organizations unable to patch immediately should consider restricting network access to the Xstore Mobile HTTP endpoint to trusted internal retail network segments or VPN-authenticated clients, which reduces the attack surface by removing remote low-privileged access paths. Additionally, audit and tighten role-based access controls within Xstore to minimize the data scope reachable by low-privileged sessions. Note that network restriction does not eliminate the underlying flaw and patching remains the definitive fix.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today