Oracle BI Publisher CVE-2026-91518

Exploitation requires the attacker to possess valid low-privileged credentials to Oracle BI Publisher (CVSS PR:L) and network HTTP access to the BI Publisher Security component; no user interaction is needed (UI:N). Affected deployments are Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The primary limiting factor is the authentication prerequisite - this is not reachable by a fully unauthenticated attacker - and impact is bounded to partial read of a data subset and partial insert/update/delete on some accessible data, with no availability impact. No specific non-default feature or configuration setting is named in the description as a precondition.

This is a moderate-severity (CVSS 3.1 base 5.4) authenticated vulnerability in Oracle BI Publisher. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms a network-exploitable, low-complexity flaw that nonetheless requires the attacker to already hold low-level privileges (PR:L) - Oracle's own text calls it 'easily exploitable' by a 'low privileged attacker with network access via HTTP.' Impact is limited: partial confidentiality and integrity (C:L/I:L), no availability impact (A:N), and no scope change (S:U), consistent with unauthorized read of a data subset and unauthorized insert/update/delete to some accessible data. No EPSS score, CISA KEV listing, or public POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Overall this reads as a genuine but not top-priority issue: it needs an existing authenticated foothold and yields only partial impact, so it ranks below any unauthenticated or RCE-class Oracle CPU item. The 'Authentication Bypass' tag conflicts with the PR:L requirement and the 'low privileged attacker' wording - it should be treated as suspect and verified against the Oracle advisory. CWE is N/A and no dedicated vendor advisory beyond the October 2026 CPU landing page was provided.

An attacker who already holds a low-privileged BI Publisher account (or has compromised such credentials) sends crafted HTTP requests to the BI Publisher Security component to reach data and operations beyond their authorization level. This lets them read a subset of otherwise restricted reporting data and insert, modify, or delete some accessible records. No public proof-of-concept was identified at the time of analysis, and no user interaction is required.