---
id: "CVE-2026-101375"
kind: "vulnerability"
aliases: ["CVE-2026-101375"]
title: "Oracle REST Data Services: low-privilege users can read, change and delete data"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle-database", "oracle-rest-data-services", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:17:45+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:01:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101375", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle REST Data Services: low-privilege users can read, change and delete data

Oracle REST Data Services, in its Database Actions component, has a flaw that lets a low-privileged user reach data they should not. An attacker over HTTP can read a subset of accessible data, modify or delete some records, and cause a partial denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle REST Data Services version (for example with `java -jar ords.war version` or the ORDS installation's version output; exact command unknown from sources)
- Confirm whether Database Actions is enabled on the ORDS instance (unknown from sources)

## Fix

- Move Oracle REST Data Services to a patched release beyond `26.1.0` for the 24.2.0 to 26.1.0 range (exact fixed version unknown from sources)
- Apply the patch from the Oracle Critical Patch Update advisory (unknown from sources)

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101375

## From the sources

Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_