---
id: "CVE-2026-101361"
kind: "vulnerability"
aliases: ["CVE-2026-101361"]
title: "Oracle REST Data Services: low-privileged user can read and change some data"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "oracle-database", "oracle-rest-data-services", "runtime", "self-hosted"]
not_affected_if: ["no-ords-deployment", "versions-outside-range"]
published_at: "2026-10-20T22:17:43+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:41:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101361", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle REST Data Services: low-privileged user can read and change some data

A flaw in the Core component of Oracle REST Data Services lets a low-privileged user reach data over HTTP that they should not reach. An attacker can read a subset of accessible data and modify or delete some of it, but cannot take down the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0`
- Confirm the version with `java -jar ords.war version` or the ORDS install directory, which the sources do not specify in detail: unknown

## Fix

- Move Oracle REST Data Services to a release outside `24.2.0` to `26.1.0` as listed in the Oracle Critical Patch Update advisory; the exact fixed version is unknown from the sources

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101361

## From the sources

Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_