{"id":"CVE-2026-91518","kind":"vulnerability","aliases":["CVE-2026-91518"],"related":[],"title":"Oracle BI Publisher: low-privilege users can read and change some data","description":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","summary":"A flaw in the BI Publisher security component of Oracle Analytics lets a low-privileged user reached over HTTP read a subset of accessible data and modify or delete some of it. The sources rate it CVSS 5.4 with confidentiality and integrity impact and no availability impact.","severity":"medium","cvss":5.4,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bi-publisher","oracle","oracle-analytics","self-hosted","vendor"],"not_affected_if":["not-running-bi-publisher","unaffected-version"],"how_to_check":"- Check the installed BI Publisher version against the affected list: `8.2.0.0.0`, `12.2.1.4.0`, `26.01.0.0.0`\n- Confirm in Oracle's Critical Patch Update advisory which patch covers your release (unknown from these sources)","fix":"- Apply the Oracle Critical Patch Update fix for your BI Publisher release (the patched version is unknown from these sources)\n- Until patched, limit HTTP access to BI Publisher to trusted networks (unknown from these sources)","status":"open","published_at":"2026-10-20T22:20:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:14:44+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:14:44Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for your BI Publisher release (the patched version is unknown from these sources)\n- Until patched, limit HTTP access to BI Publisher to trusted networks (unknown from these sources)","reach":"network","title":"Oracle BI Publisher: low-privilege users can read and change some data","impact":"medium","summary":"A flaw in the BI Publisher security component of Oracle Analytics lets a low-privileged user reached over HTTP read a subset of accessible data and modify or delete some of it. The sources rate it CVSS 5.4 with confidentiality and integrity impact and no availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle","bi-publisher","oracle-analytics","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged user alters or deletes some stored data","analyst_note":"Find the Oracle CPU advisory for CVE-2026-91518 to confirm patched versions and any workaround; sources do not give them.","how_to_check":"- Check the installed BI Publisher version against the affected list: `8.2.0.0.0`, `12.2.1.4.0`, `26.01.0.0.0`\n- Confirm in Oracle's Critical Patch Update advisory which patch covers your release (unknown from these sources)","needs_analyst":true,"not_affected_if":["not-running-bi-publisher","unaffected-version"],"who_is_affected":"Teams running Oracle BI Publisher in the affected releases where low-privileged accounts can reach the web interface over the network. Deployments limited to trusted internal users behind strict network controls have less exposure. Teams not running BI Publisher can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3517,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91518':16A,19A '/av':170C '12.2.1.4.0':100C '26.01.0.0.0':102C '3.1':158C,169C '5.4':69B,161C '8.2.0.0.0':99C 'access':55B,112C,133C,140C,147C,155C 'affect':97C 'allow':106C 'analyt':26B,41B,88C 'attack':109C,121C 'avail':77B 'base':159C 'bi':2A,21B,35B,83C,90C,118C,138C,153C 'bi-publish':20B 'chang':11A 'compon':38B,89C 'compromis':116C 'confidenti':71B,162C 'cve':14A,17A 'cvss':68B,157C,166C,168C 'data':13A,56B,141C,156C 'delet':60B,132C 'easili':103C 'exploit':104C 'flaw':32B 'host':29B 'http':50B,114C 'impact':74B,78B,165C 'insert':130C 'integr':73B,164C 'l/a':177C 'l/i':176C 'l/pr':172C 'l/ui':173C 'let':42B 'low':5A,45B,107C 'low-privileg':4A,44B 'modifi':58B 'n':178C 'n/ac':171C 'n/s':174C 'network':111C 'oracl':1A,23B,25B,40B,82C,87C,117C,137C,152C 'oracle-analyt':24B 'privileg':6A,46B,108C 'product':85C 'publish':3A,22B,36B,84C,91C,119C,139C,154C 'rate':66B 'reach':48B 'read':9A,51B,146C 'result':126C 'score':160C 'secur':37B,92C 'self':28B 'self-host':27B 'sourc':65B 'subset':53B,150C 'success':120C 'support':93C 'u/c':175C 'unauthor':128C,145C 'updat':129C 'user':7A,47B 'vector':167C 'vendor':30B 'version':94C 'via':113C 'vulner':79C,105C,124C 'well':143C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle BI Publisher in the affected releases where low-privileged accounts can reach the web interface over the network. Deployments limited to trusted internal users behind strict network controls have less exposure. Teams not running BI Publisher can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91518","severity":null,"published_at":"2026-10-20T22:20:55+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91518","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91518","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}