---
id: "CVE-2026-91412"
kind: "vulnerability"
aliases: ["CVE-2026-91412"]
title: "Oracle Siebel CRM End User: low-privilege HTTP flaw exposes accessible data"
severity: "medium"
cvss: 6.5
epss: 0.00341
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-crm", "oracle", "siebel-crm", "vendor"]
not_affected_if: ["not-running-siebel"]
published_at: "2026-10-20T22:20:44+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91412", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91412", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle Siebel CRM End User: low-privilege HTTP flaw exposes accessible data

Oracle Siebel CRM End User has a flaw in its Open UI component that lets a low-privileged user reach data over HTTP. A successful attack gives the attacker unauthorized read access to critical data accessible to the End User application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Siebel CRM End User is deployed and which version runs, comparing against the affected range 17.0-26.9 in the sources
- unknown for any further check, as the sources do not give a command or setting

## Fix

- Apply the Oracle Siebel CRM patch or update for the affected release line, per Oracle's Critical Patch Update advisory
- unknown for exact fixed version numbers, as the sources do not say

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91412
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91412

## From the sources

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_