{"id":"CVE-2026-91412","kind":"vulnerability","aliases":["CVE-2026-91412"],"related":[],"title":"Oracle Siebel CRM End User: low-privilege HTTP flaw exposes accessible data","description":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle Siebel CRM End User has a flaw in its Open UI component that lets a low-privileged user reach data over HTTP. A successful attack gives the attacker unauthorized read access to critical data accessible to the End User application.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-crm","oracle","siebel-crm","vendor"],"not_affected_if":["not-running-siebel"],"how_to_check":"- Confirm whether Siebel CRM End User is deployed and which version runs, comparing against the affected range 17.0-26.9 in the sources\n- unknown for any further check, as the sources do not give a command or setting","fix":"- Apply the Oracle Siebel CRM patch or update for the affected release line, per Oracle's Critical Patch Update advisory\n- unknown for exact fixed version numbers, as the sources do not say","status":"open","published_at":"2026-10-20T22:20:44+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:50:48+00:00","updated_at":"2026-10-25T03:50:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:50:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Siebel CRM patch or update for the affected release line, per Oracle's Critical Patch Update advisory\n- unknown for exact fixed version numbers, as the sources do not say","reach":"internet","title":"Oracle Siebel CRM End User: low-privilege HTTP flaw exposes accessible data","impact":"medium","summary":"Oracle Siebel CRM End User has a flaw in its Open UI component that lets a low-privileged user reach data over HTTP. A successful attack gives the attacker unauthorized read access to critical data accessible to the End User application.","category":"vendor","nicknames":[],"who_cares":["siebel-crm","oracle","enterprise-crm"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data accessible to Siebel End User","analyst_note":"Check Oracle's Siebel CPU advisory for fixed versions and any configuration prerequisites; the NVD entry gives only the affected range.","how_to_check":"- Confirm whether Siebel CRM End User is deployed and which version runs, comparing against the affected range 17.0-26.9 in the sources\n- unknown for any further check, as the sources do not give a command or setting","needs_analyst":true,"not_affected_if":["not-running-siebel"],"who_is_affected":"Organisations running Oracle Siebel CRM End User in the affected version range 17.0-26.9 with the Open UI component reachable over HTTP. The sources do not describe the configuration needed beyond a low-privileged account, so teams not running Siebel CRM End User can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3451,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-26.9':92C '-91412':16A,19A '/av':146C '17.0':91C '3.1':136C,145C '6.5':139C 'access':12A,60B,64B,102C,120C,126C,133C 'affect':89C 'allow':96C 'applic':69B 'attack':54B,57B,99C,112C 'base':137C 'complet':125C 'compon':40B,82C 'compromis':106C 'confidenti':140C 'critic':62B,122C 'crm':3A,22B,26B,30B,74C,81C,108C,130C 'cve':14A,17A 'cvss':135C,142C,144C 'data':13A,49B,63B,123C,134C 'easili':93C 'end':4A,31B,67B,75C,109C,131C 'enterpris':21B 'enterprise-crm':20B 'exploit':94C 'expos':11A 'flaw':10A,35B 'give':55B 'h/i':152C 'http':9A,51B,104C 'impact':141C 'l/pr':148C 'l/ui':149C 'let':42B 'low':7A,45B,97C 'low-privileg':6A,44B 'n':154C 'n/a':153C 'n/ac':147C 'n/s':150C 'network':101C 'open':38B,83C 'oracl':1A,23B,28B,79C 'privileg':8A,46B,98C 'product':77C 'reach':48B 'read':59B 'result':117C 'score':138C 'siebel':2A,25B,29B,73C,80C,107C,129C 'siebel-crm':24B 'success':53B,111C 'support':85C 'u/c':151C 'ui':39B,84C 'unauthor':58B,119C 'user':5A,32B,47B,68B,76C,110C,132C 'vector':143C 'vendor':27B 'version':86C 'via':103C 'vulner':70C,95C,115C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle Siebel CRM End User in the affected version range 17.0-26.9 with the Open UI component reachable over HTTP. The sources do not describe the configuration needed beyond a low-privileged account, so teams not running Siebel CRM End User can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91412","severity":null,"published_at":"2026-10-20T22:20:44+00:00","modified_at":"2026-10-23T20:17:29+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}