{"id":"CVE-2026-101373","kind":"vulnerability","aliases":["CVE-2026-101373"],"related":[],"title":"Oracle REST Data Services: high-privilege user can alter some stored data","description":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 2.4 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N).","summary":"Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that lets a highly privileged remote user make limited unauthorized changes to some accessible data. The attack needs a second person to take an action, and the sources score it low at CVSS 2.4 with integrity impact only.","severity":"low","cvss":2.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-rest-data-services","runtime","self-hosted"],"not_affected_if":[],"how_to_check":"- Run the installed version of Oracle REST Data Services and compare it against `24.2.0` through `26.1.0`\n- unknown for other checks, since the sources do not describe configuration details","fix":"- Move Oracle REST Data Services to a release newer than `26.1.0` once Oracle publishes a fixed build; the sources do not name the fixed version","status":"open","published_at":"2026-10-20T22:17:44+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:49:38+00:00","updated_at":"2026-10-25T04:49:38+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:49:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a release newer than `26.1.0` once Oracle publishes a fixed build; the sources do not name the fixed version","reach":"network","title":"Oracle REST Data Services: high-privilege user can alter some stored data","impact":"low","summary":"Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that lets a highly privileged remote user make limited unauthorized changes to some accessible data. The attack needs a second person to take an action, and the sources score it low at CVSS 2.4 with integrity impact only.","category":"runtime","nicknames":[],"who_cares":["oracle-rest-data-services","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker alters or deletes some data reachable through the service","analyst_note":"Check Oracle's Critical Patch Update advisory or the NVD entry for the fixed version and any configuration details; the sources only give the CVSS vector and affected range.","how_to_check":"- Run the installed version of Oracle REST Data Services and compare it against `24.2.0` through `26.1.0`\n- unknown for other checks, since the sources do not describe configuration details","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Oracle REST Data Services in the affected range that expose it over HTTP to users who hold high privileges. The sources do not say which configurations are exposed beyond the affected version range, so exposure is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000624,"input_tokens":3445,"output_tokens":559,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101373':16A,19A '-2026':15A,18A '/av':161C '2.4':77B,154C '24.2.0':34B,95C '26.1.0':36B,96C '3.1':151C,160C 'access':57B,106C,140C,148C 'action':68B 'affect':93C 'allow':100C 'alter':10A 'attack':60B,103C,116C,126C,128C 'base':152C 'chang':54B 'compon':43B,87C 'compromis':110C 'core':42B,88C 'cve':14A,17A 'cvss':76B,150C,157C,159C 'data':3A,13A,23B,31B,58B,85C,113C,146C,149C 'delet':139C 'easili':97C 'exploit':98C 'flaw':39B 'h/ui':164C 'high':6A,47B,101C 'high-privileg':5A 'host':28B 'http':108C 'human':118C 'impact':80B,156C 'insert':137C 'integr':79B,155C 'interact':119C 'l/a':168C 'l/pr':163C 'let':45B 'limit':52B 'low':74B 'make':51B 'n':169C 'n/ac':162C 'n/i':167C 'need':61B 'network':105C 'oracl':1A,21B,29B,83C,111C,144C 'oracle-rest-data-servic':20B 'person':64B,122C 'privileg':7A,48B,102C 'r/s':165C 'remot':49B 'requir':117C 'rest':2A,22B,30B,84C,112C,145C 'result':133C 'runtim':25B 'score':72B,153C 'second':63B 'self':27B 'self-host':26B 'servic':4A,24B,32B,86C,114C,147C 'sourc':71B 'store':12A 'success':115C,127C 'support':89C 'take':66B 'u/c':166C 'unauthor':53B,135C 'updat':136C 'user':8A,50B 'vector':158C 'version':33B,90C 'via':107C 'vulner':81C,99C,131C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle REST Data Services in the affected range that expose it over HTTP to users who hold high privileges. The sources do not say which configurations are exposed beyond the affected version range, so exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101373","severity":null,"published_at":"2026-10-20T22:17:44+00:00","modified_at":"2026-10-21T19:16:48+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}