Oracle Workflow CVE-2026-60830

The attacker must possess a valid low-privileged Oracle E-Business Suite account (PR:L per CVSS vector). The Oracle EBS application server's Worklist HTTP endpoint must be network-reachable by the attacker - whether internally (corporate LAN) or externally if the EBS instance is internet-exposed. No non-default configuration or special feature flag is indicated as a prerequisite; the Worklist component is a standard part of Oracle Workflow in all affected EBS 12.2.x deployments. Factors limiting exploitation: (1) a valid EBS credential is required - the CVSS PR:L metric rules out unauthenticated exploitation; (2) the vulnerability is bounded to versions 12.2.3-12.2.15, excluding unaffected EBS versions; (3) impact is read-only (C:H, I:N, A:N), meaning attackers cannot modify or delete workflow data through this vector alone; and (4) scope is unchanged (S:U), confining exposure to Oracle Workflow data rather than the broader EBS system.

The CVSS 3.1 score of 6.5 (Medium) captures a network-accessible, low-complexity vulnerability requiring low privileges and no user interaction, with a High confidentiality impact and no integrity or availability effect. Oracle's own language - 'easily exploitable' - reinforces AC:L and the absence of UI requirements, indicating a low-friction exploitation path for any valid EBS account holder. The 'Authentication Bypass' tag from the EUVD entry introduces a nuance: while PR:L indicates that a session is required, the tag implies privilege escalation or authorization bypass beyond that session's intended scope - meaning even the most constrained EBS user could potentially read the entirety of Workflow-accessible data. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be independently quantified. The vulnerability is absent from the CISA KEV catalog and no public POC has been identified, suggesting no confirmed widespread exploitation at time of analysis. Real-world business risk is elevated by the nature of Oracle Workflow data - which typically includes financial approvals, HR actions, and procurement authorizations - making unauthorized read access organizationally significant even without code execution. The scope-unchanged (S:U) rating bounds the blast radius to the Workflow system itself, which is a meaningful limitation.

An attacker holding a standard low-privileged Oracle EBS account - such as a workflow participant or employee user - submits a crafted HTTP request to the Oracle Workflow Worklist endpoint, bypassing authorization checks that should restrict data visibility to the attacker's own tasks. The authorization bypass allows the attacker to retrieve workflow records, approval chains, and associated metadata across all users and processes within the Workflow system. No public POC has been identified, but Oracle's characterization of the flaw as 'easily exploitable' with AC:L and no UI requirement suggests minimal technical sophistication is needed beyond possession of a valid EBS credential.