---
id: "CVE-2026-91577"
kind: "vulnerability"
aliases: ["CVE-2026-91577"]
title: "Oracle Business Intelligence: low-privilege users can read and change some data"
severity: "medium"
cvss: 6.4
epss: 0.00183
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle-analytics", "oracle-bi", "self-hosted", "vendor"]
not_affected_if: ["other-versions"]
published_at: "2026-10-20T22:20:59+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91577", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91577", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Business Intelligence: low-privilege users can read and change some data

Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 has a flaw in its BI Platform Security component. A user with low privileges and network access over HTTP can read and modify a subset of the data the BI server can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BI version against `12.2.1.4.0`
- Review the Oracle Critical Patch Update advisory listed for this CVE for the patch identifier (unknown from the sources)

## Fix

- Apply the Oracle Critical Patch Update that covers BI Enterprise Edition 12.2.1.4.0 (patch identifier unknown from the sources)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91577
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91577

## From the sources

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_