Oracle BI EE CVE-2026-91523

Exploitation requires the attacker to hold a valid low-privileged account on Oracle Business Intelligence Enterprise Edition (PR:L) and to induce a separate user to interact with attacker-supplied content (UI:R) - typically viewing a malicious report, dashboard, or analytics object served by the Analytics Web General component over HTTP. The flaw affects BI EE versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Key limiting factors: it is not remote-unauthenticated (an account is needed), it cannot fire without victim interaction, and impact is partial (unauthorized read of a subset of data plus limited update/insert/delete, no availability impact), though the scope change means successful attacks may affect additional products beyond BI EE itself.

This is a moderate-priority issue that should be patched in routine cycles rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable but low-privilege (PR:L) flaw that additionally requires human interaction from a victim other than the attacker (UI:R) and yields only partial confidentiality and integrity impact with no availability impact. The scope change (S:C) plus UI:R strongly indicates a stored/reflected cross-site scripting or similar injection where a low-privileged attacker plants content that executes in another user's authenticated session. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are internally consistent in pointing to a meaningful-but-not-critical issue. The 'Authentication Bypass' tag CONFLICTS with the CVSS data: PR:L means the attacker must already be authenticated/low-privileged, and the C:L/I:L/UI:R/S:C profile is characteristic of XSS, not an auth bypass - treat the tag as likely mislabeled and verify against the Oracle CPU note. Overall real-world risk is tempered by the required victim interaction and the attacker's need for some existing access.

A low-privileged but authenticated Oracle BI EE user crafts a malicious payload (e.g., in a report, dashboard, or analytics object) and lures a higher-privileged user to view it; when that victim opens the content, attacker-controlled script executes in the victim's authenticated context, enabling unauthorized reads and limited data modification that can cross into additional products (scope change). No public exploit code is identified at time of analysis, and the required human interaction raises the bar for reliable exploitation.