---
id: "CVE-2026-91261"
kind: "vulnerability"
aliases: ["CVE-2026-91261"]
title: "Oracle WebCenter Content: low-privilege user can read some stored data"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle", "self-hosted", "vendor", "webcenter-content"]
not_affected_if: ["no-webcenter", "other-release"]
published_at: "2026-10-20T22:20:27+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T04:47:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91261", "first_seen_at": "2026-10-23T21:57:26+00:00"}]
---

# Oracle WebCenter Content: low-privilege user can read some stored data

Oracle WebCenter Content Server 14.1.2.0.0 has a flaw that lets a low-privileged user reach it over HTTP and read a subset of the content it stores. The sources describe only unauthorized read access, with no write or code execution impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WebCenter Content version in the Oracle Fusion Middleware console or the Content Server admin page; the affected release is `14.1.2.0.0`.
- unknown for any other specific file or setting

## Fix

- Apply the Oracle Critical Patch Update for Fusion Middleware that covers WebCenter Content `14.1.2.0.0`; the exact patch id is unknown from the sources.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91261

## From the sources

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_