{"id":"CVE-2026-101375","kind":"vulnerability","aliases":["CVE-2026-101375"],"related":[],"title":"Oracle REST Data Services: low-privilege users can read, change and delete data","description":"Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).","summary":"Oracle REST Data Services, in its Database Actions component, has a flaw that lets a low-privileged user reach data they should not. An attacker over HTTP can read a subset of accessible data, modify or delete some records, and cause a partial denial of service.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-database","oracle-rest-data-services","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Oracle REST Data Services version (for example with `java -jar ords.war version` or the ORDS installation's version output; exact command unknown from sources)\n- Confirm whether Database Actions is enabled on the ORDS instance (unknown from sources)","fix":"- Move Oracle REST Data Services to a patched release beyond `26.1.0` for the 24.2.0 to 26.1.0 range (exact fixed version unknown from sources)\n- Apply the patch from the Oracle Critical Patch Update advisory (unknown from sources)","status":"open","published_at":"2026-10-20T22:17:45+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:01:36+00:00","updated_at":"2026-10-25T04:01:36+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:01:36Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a patched release beyond `26.1.0` for the 24.2.0 to 26.1.0 range (exact fixed version unknown from sources)\n- Apply the patch from the Oracle Critical Patch Update advisory (unknown from sources)","reach":"internet","title":"Oracle REST Data Services: low-privilege users can read, change and delete data","impact":"medium","summary":"Oracle REST Data Services, in its Database Actions component, has a flaw that lets a low-privileged user reach data they should not. An attacker over HTTP can read a subset of accessible data, modify or delete some records, and cause a partial denial of service.","category":"vendor","nicknames":[],"who_cares":["oracle-rest-data-services","oracle-database","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads some data and changes or deletes some records","analyst_note":"Find the Oracle CPU advisory entry and the exact fixed ORDS version and check instructions; the NVD record alone does not give them.","how_to_check":"- Check the installed Oracle REST Data Services version (for example with `java -jar ords.war version` or the ORDS installation's version output; exact command unknown from sources)\n- Confirm whether Database Actions is enabled on the ORDS instance (unknown from sources)","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Oracle REST Data Services versions 24.2.0 through 26.1.0 with Database Actions reachable over HTTP. An attacker needs a low-privileged account on the service. Teams on other versions or without Database Actions exposed can likely skip it, though the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3508,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101375':17A,20A '-2026':16A,19A '/av':185C '24.2.0':95C '26.1.0':96C '3.1':172C,184C '6.3':175C 'abil':156C 'access':66B,106C,128C,136C,143C,152C 'action':40B,88C 'affect':93C 'allow':100C 'attack':58B,103C,116C 'avail':179C 'base':173C 'caus':74B,158C 'chang':11A 'compon':41B,86C 'compromis':110C 'confidenti':176C 'cve':15A,18A 'cvss':171C,181C,183C 'data':3A,14A,27B,35B,53B,67B,84C,113C,134C,137C,150C,153C,169C 'databas':23B,39B,87C 'delet':13A,70B,127C 'denial':77B,161C 'dos':165C 'easili':97C 'exploit':98C 'flaw':44B 'host':31B 'http':60B,108C 'impact':180C 'insert':125C 'integr':177C 'l':193C 'l/a':192C 'l/i':191C 'l/pr':187C 'l/ui':188C 'let':46B 'low':6A,49B,101C 'low-privileg':5A,48B 'modifi':68B 'n/ac':186C 'n/s':189C 'network':105C 'oracl':1A,22B,25B,33B,82C,111C,132C,148C,167C 'oracle-databas':21B 'oracle-rest-data-servic':24B 'partial':76B,160C,164C 'privileg':7A,50B,102C 'reach':52B 'read':10A,62B,142C 'record':72B 'rest':2A,26B,34B,83C,112C,133C,149C,168C 'result':121C 'score':174C 'self':30B 'self-host':29B 'servic':4A,28B,36B,79B,85C,114C,135C,151C,163C,170C 'subset':64B,146C 'success':115C 'support':89C 'u/c':190C 'unauthor':123C,141C,155C 'updat':124C 'user':8A,51B 'vector':182C 'vendor':32B 'version':90C 'via':107C 'vulner':80C,99C,119C 'well':139C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle REST Data Services versions 24.2.0 through 26.1.0 with Database Actions reachable over HTTP. An attacker needs a low-privileged account on the service. Teams on other versions or without Database Actions exposed can likely skip it, though the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101375","severity":null,"published_at":"2026-10-20T22:17:45+00:00","modified_at":"2026-10-21T19:16:48+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}