Oracle Siebel CRM CVE-2026-91412

Requires a valid low-privilege Siebel CRM End User account and network access to the Siebel Open UI web tier over HTTP (PR:L, AV:N, UI:N). No end-user interaction is needed and attack complexity is low, but the attacker must already be authenticated - there is no unauthenticated path per the vendor vector. Affected deployments are Siebel CRM End User versions 17.0 through 26.9; the limiting factor is possession of credentials, which bounds this to insiders or attackers who have otherwise obtained a low-tier account.

The authoritative signal is Oracle's own CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5 MEDIUM): network-reachable over HTTP, low attack complexity, but requiring low-level privileges (PR:L) and yielding confidentiality-only impact (C:H/I:N/A:N) with unchanged scope. No EPSS score was supplied, this CVE is not on CISA KEV, and no public exploit code was referenced - so there is no public exploit identified at time of analysis. The practical risk is a moderate, authenticated information-disclosure flaw rather than an unauthenticated remote-code-execution emergency: an already-authenticated (even low-privilege) Siebel user can read data they should not, potentially all data accessible to the Siebel CRM End User tier. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which explicitly requires privileges (PR:L) - a genuine authentication bypass would be PR:N. Treat the 'Authentication Bypass' label as unverified and defer to the vendor vector, which indicates an authenticated attacker. Because CWE is N/A and no technical detail beyond 'unauthorized access to critical data' is given, the precise mechanism (e.g., IDOR, broken access control in Open UI) cannot be confirmed from available data.

A user holding any low-privilege Siebel CRM End User account authenticates to the Open UI web interface and sends crafted HTTP requests that return business data outside their authorization scope, resulting in exposure of critical or all end-user-accessible records. No public proof-of-concept was referenced, and the low attack complexity (AC:L) means exploitation needs no special timing or conditions once the attacker is authenticated.