---
id: "CVE-2026-91518"
kind: "vulnerability"
aliases: ["CVE-2026-91518"]
title: "Oracle BI Publisher: low-privilege users can read and change some data"
severity: "medium"
cvss: 5.4
epss: 0.00183
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["bi-publisher", "oracle", "oracle-analytics", "self-hosted", "vendor"]
not_affected_if: ["not-running-bi-publisher", "unaffected-version"]
published_at: "2026-10-20T22:20:55+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91518", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91518", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle BI Publisher: low-privilege users can read and change some data

A flaw in the BI Publisher security component of Oracle Analytics lets a low-privileged user reached over HTTP read a subset of accessible data and modify or delete some of it. The sources rate it CVSS 5.4 with confidentiality and integrity impact and no availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BI Publisher version against the affected list: `8.2.0.0.0`, `12.2.1.4.0`, `26.01.0.0.0`
- Confirm in Oracle's Critical Patch Update advisory which patch covers your release (unknown from these sources)

## Fix

- Apply the Oracle Critical Patch Update fix for your BI Publisher release (the patched version is unknown from these sources)
- Until patched, limit HTTP access to BI Publisher to trusted networks (unknown from these sources)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91518
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91518

## From the sources

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_