EUVD-2026-46453
GHSA-whr8-w9qr-c6m2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local attack vector confirmed; PR:L reflects required infrastructure logon; C:L caps partial read impact; no integrity or availability effects present.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is affected is 21.0.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Retail Xstore Point of Service executes to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Local privilege information disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows low-privileged users with system logon access to read a subset of Xstore data they are not authorized to view via the Xstore Mobile component. Despite carrying the 'Authentication Bypass' tag, the CVSS vector (AV:L/PR:L) confirms exploitation requires existing local infrastructure access - the bypass likely permits an authenticated low-privilege user to circumvent authorization controls and access restricted data segments. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unlikely in the near term.
Technical ContextAI
Oracle Retail Xstore Point of Service is an enterprise-grade retail POS platform, and the affected component is Xstore Mobile, the mobile interface layer of the suite. The CPE string (cpe:2.3:a:oracle_corporation:oracle_retail_xstore_point_of_service:*:*:*:*:*:*:*:*) with the EUVD-confirmed affected version 21.0.3 scopes the exposure precisely. No CWE is assigned by Oracle, which is common for Oracle CPU advisories that treat root cause classification as proprietary. However, the 'Authentication Bypass' tag in conjunction with PR:L suggests an authorization control failure - likely an improper access control issue (analogous to CWE-284 or CWE-863) where a low-privilege session can access data beyond its intended authorization boundary within the Xstore Mobile module. The local attack vector (AV:L) indicates the flaw manifests on the host infrastructure running the Xstore service, not over the network.
RemediationAI
Apply the patch provided by Oracle as part of the Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so applying the July 2026 CPU to the Xstore 21.0.3 installation should address this vulnerability; however, the exact patched version number is not independently confirmed in the available intelligence data - verify the specific patch artifact version with Oracle Support before deployment. As a compensating control while patching, restrict logon access to the infrastructure hosting Oracle Retail Xstore Point of Service to only those personnel and service accounts with a documented operational need, reducing the pool of accounts that could exploit the authorization bypass. Disabling the Xstore Mobile component entirely is a high-impact workaround if the feature is not operationally required, but this should be assessed for retail operational impact before implementation.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today