EUVD-2026-79775
GHSA-j2pc-f79r-w4mh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
HTTP-reachable authorization flaw requiring only a valid low-privilege account, so PR:L and AC:L; integrity and confidentiality limited, availability unaffected.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Oracle Helidon 4.0.0 through 4.5.4 contains an authorization weakness in the helidon-microprofile-security component that allows a low-privileged user with ordinary HTTP network access to read a subset of Helidon-accessible data and to insert, update or delete records they should not reach, with no user interaction required. The defect is trivially reachable (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning any valid low-privilege account is enough to over-reach, though availability is unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Prerequisites: the application must be running Oracle Helidon 4.0.0-4.5.4 with the helidon-microprofile-security component actually included and its secured REST endpoints reachable over HTTP from the attacker's network position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4) drives the picture: exploitation is network-reachable and requires no complexity or user interaction, but it demands a valid low-privileged account, which is a real but modest hurdle in multi-tenant or self-service deployments and a near-zero hurdle where anonymous or broadly-issued accounts exist. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle publishes fixes for Fusion Middleware/Helidon issues through its Critical Patch Update process, so the primary action is to upgrade Helidon to a release above 4.5.4 as documented in the referenced Oracle security alert (https://www.oracle.com/security-alerts/cspusep2026.html); the input data does not name a specific fixed build, so confirm the patched version on that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today