---
id: "CVE-2026-101373"
kind: "vulnerability"
aliases: ["CVE-2026-101373"]
title: "Oracle REST Data Services: high-privilege user can alter some stored data"
severity: "low"
cvss: 2.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["oracle-rest-data-services", "runtime", "self-hosted"]
not_affected_if: []
published_at: "2026-10-20T22:17:44+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:49:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101373", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle REST Data Services: high-privilege user can alter some stored data

Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that lets a highly privileged remote user make limited unauthorized changes to some accessible data. The attack needs a second person to take an action, and the sources score it low at CVSS 2.4 with integrity impact only.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run the installed version of Oracle REST Data Services and compare it against `24.2.0` through `26.1.0`
- unknown for other checks, since the sources do not describe configuration details

## Fix

- Move Oracle REST Data Services to a release newer than `26.1.0` once Oracle publishes a fixed build; the sources do not name the fixed version

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101373

## From the sources

Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 2.4 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_