{"id":"CVE-2026-91261","kind":"vulnerability","aliases":["CVE-2026-91261"],"related":[],"title":"Oracle WebCenter Content: low-privilege user can read some stored data","description":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle WebCenter Content Server 14.1.2.0.0 has a flaw that lets a low-privileged user reach it over HTTP and read a subset of the content it stores. The sources describe only unauthorized read access, with no write or code execution impact.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","self-hosted","vendor","webcenter-content"],"not_affected_if":["no-webcenter","other-release"],"how_to_check":"- Check the installed WebCenter Content version in the Oracle Fusion Middleware console or the Content Server admin page; the affected release is `14.1.2.0.0`.\n- unknown for any other specific file or setting","fix":"- Apply the Oracle Critical Patch Update for Fusion Middleware that covers WebCenter Content `14.1.2.0.0`; the exact patch id is unknown from the sources.","status":"open","published_at":"2026-10-20T22:20:27+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:47:36+00:00","updated_at":"2026-10-25T04:47:36+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:47:36Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Fusion Middleware that covers WebCenter Content `14.1.2.0.0`; the exact patch id is unknown from the sources.","reach":"network","title":"Oracle WebCenter Content: low-privilege user can read some stored data","impact":"low","summary":"Oracle WebCenter Content Server 14.1.2.0.0 has a flaw that lets a low-privileged user reach it over HTTP and read a subset of the content it stores. The sources describe only unauthorized read access, with no write or code execution impact.","category":"vendor","nicknames":[],"who_cares":["oracle","webcenter-content","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Some stored content readable by a low-privileged account over HTTP.","analyst_note":"Check the Oracle Security Alert or CPU advisory for the patch id and the exact affected configurations; the NVD entry alone gives no fix.","how_to_check":"- Check the installed WebCenter Content version in the Oracle Fusion Middleware console or the Content Server admin page; the affected release is `14.1.2.0.0`.\n- unknown for any other specific file or setting","needs_analyst":true,"not_affected_if":["other-release","no-webcenter"],"who_is_affected":"Teams running Oracle WebCenter Content Server 14.1.2.0.0 that accept HTTP access from users with some low-privilege account. The sources do not say which configurations expose the flaw beyond that, so unknown for the rest. Systems on other releases or with no WebCenter Content deployment can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000645,"input_tokens":3458,"output_tokens":598,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91261':15A,18A '/av':140C '14.1.2.0.0':31B,90C '3.1':130C,133C,139C 'access':61B,101C,119C,127C 'affect':88C 'allow':95C 'attack':98C,110C 'base':131C 'code':66B 'compon':80C 'compromis':105C 'confidenti':134C 'content':3A,26B,29B,52B,74C,81C,108C,126C 'cve':13A,16A 'cvss':129C,136C,138C 'data':12A,128C 'describ':57B 'difficult':91C 'execut':67B 'exploit':93C 'flaw':34B 'fusion':78C 'h/pr':142C 'host':22B 'http':45B,103C 'impact':68B,135C 'l/i':146C 'l/ui':143C 'let':36B 'low':5A,39B,96C 'low-privileg':4A,38B 'middlewar':79C 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'network':100C 'oracl':1A,19B,27B,72C,77C,106C,124C 'privileg':6A,40B,97C 'product':75C 'reach':42B 'read':9A,47B,60B,118C 'result':115C 'score':132C 'self':21B 'self-host':20B 'server':30B,82C 'sourc':56B 'store':11A,54B 'subset':49B,122C 'success':109C 'support':84C 'u/c':145C 'unauthor':59B,117C 'user':7A,41B 'vector':137C 'vendor':23B 'version':85C 'via':102C 'vulner':69C,94C,113C 'webcent':2A,25B,28B,73C,107C,125C 'webcenter-cont':24B 'write':64B","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle WebCenter Content Server 14.1.2.0.0 that accept HTTP access from users with some low-privilege account. The sources do not say which configurations expose the flaw beyond that, so unknown for the rest. Systems on other releases or with no WebCenter Content deployment can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91261","severity":null,"published_at":"2026-10-20T22:20:27+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}