{"id":"CVE-2026-101361","kind":"vulnerability","aliases":["CVE-2026-101361"],"related":[],"title":"Oracle REST Data Services: low-privileged user can read and change some data","description":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","summary":"A flaw in the Core component of Oracle REST Data Services lets a low-privileged user reach data over HTTP that they should not reach. An attacker can read a subset of accessible data and modify or delete some of it, but cannot take down the service.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-database","oracle-rest-data-services","runtime","self-hosted"],"not_affected_if":["no-ords-deployment","versions-outside-range"],"how_to_check":"- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0`\n- Confirm the version with `java -jar ords.war version` or the ORDS install directory, which the sources do not specify in detail: unknown","fix":"- Move Oracle REST Data Services to a release outside `24.2.0` to `26.1.0` as listed in the Oracle Critical Patch Update advisory; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-10-20T22:17:43+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:41:41+00:00","updated_at":"2026-10-25T04:41:41+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:41:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a release outside `24.2.0` to `26.1.0` as listed in the Oracle Critical Patch Update advisory; the exact fixed version is unknown from the sources","reach":"network","title":"Oracle REST Data Services: low-privileged user can read and change some data","impact":"medium","summary":"A flaw in the Core component of Oracle REST Data Services lets a low-privileged user reach data over HTTP that they should not reach. An attacker can read a subset of accessible data and modify or delete some of it, but cannot take down the service.","category":"runtime","nicknames":[],"who_cares":["oracle-rest-data-services","oracle-database","java","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged user reads and changes some REST-accessible data","analyst_note":"Confirm the fixed version and the Oracle CPU advisory link; the sources give no fix or check steps.","how_to_check":"- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0`\n- Confirm the version with `java -jar ords.war version` or the ORDS install directory, which the sources do not specify in detail: unknown","needs_analyst":true,"not_affected_if":["no-ords-deployment","versions-outside-range"],"who_is_affected":"Deployments of Oracle REST Data Services in the affected version range that accept HTTP requests from users holding a low-privileged account. Exposure depends on which schema data is served through ORDS; instances that serve no data to low-privileged users are less exposed. Teams not running ORDS in this range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3463,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101361':17A,20A '-2026':16A,19A '/av':169C '24.2.0':96C '26.1.0':97C '3.1':157C,168C '4.2':160C 'access':67B,108C,130C,138C,145C,154C 'affect':94C 'allow':102C 'attack':61B,105C,118C 'base':158C 'cannot':77B 'chang':12A 'compon':39B,88C 'compromis':112C 'confidenti':161C 'core':38B,89C 'cve':15A,18A 'cvss':156C,165C,167C 'data':3A,14A,28B,43B,52B,68B,86C,115C,136C,139C,152C,155C 'databas':24B 'delet':72B,129C 'difficult':98C 'exploit':100C 'flaw':35B 'h/pr':171C 'host':33B 'http':54B,110C 'impact':164C 'insert':127C 'integr':163C 'java':21B 'l/a':176C 'l/i':175C 'l/ui':172C 'let':45B 'low':6A,48B,103C 'low-privileg':5A,47B 'modifi':70B 'n':177C 'n/ac':170C 'n/s':173C 'network':107C 'oracl':1A,23B,26B,41B,84C,113C,134C,150C 'oracle-databas':22B 'oracle-rest-data-servic':25B 'privileg':7A,49B,104C 'reach':51B,59B 'read':10A,63B,144C 'rest':2A,27B,42B,85C,114C,135C,151C 'result':123C 'runtim':30B 'score':159C 'self':32B 'self-host':31B 'servic':4A,29B,44B,81B,87C,116C,137C,153C 'subset':65B,148C 'success':117C 'support':90C 'take':78B 'u/c':174C 'unauthor':125C,143C 'updat':126C 'user':8A,50B 'vector':166C 'version':91C 'via':109C 'vulner':82C,101C,121C 'well':141C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle REST Data Services in the affected version range that accept HTTP requests from users holding a low-privileged account. Exposure depends on which schema data is served through ORDS; instances that serve no data to low-privileged users are less exposed. Teams not running ORDS in this range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101361","severity":null,"published_at":"2026-10-20T22:17:43+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}