CVE-2026-101366 in REST Data Services
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
Oracle REST Data Services, a component within the Oracle Application Development Pack, contains a vulnerability in its ADP module that allows for unauthorized data access by low-privileged attackers. The affected software versions span from 24.2.0 through 26.1.0. This flaw is characterized as easily exploitable and requires only network access via HTTP to execute the attack vector. Because the privilege requirement is classified as low, an attacker does not need elevated system permissions or complex authentication bypasses beyond what a standard user might possess within the service context. The primary operational impact of this vulnerability is limited to confidentiality, specifically resulting in unauthorized read access to a subset of data accessible through Oracle REST Data Services. This means that while integrity and availability remain unaffected, sensitive information stored or processed by the service can be exfiltrated by malicious actors who gain network connectivity to the affected instance.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration categories related to improper access control mechanisms within web services. Specifically, it reflects issues where authentication checks are either missing for certain endpoints or insufficiently restrictive regarding role-based permissions. The attack vector is classified as Network (AV:N) and Low Complexity (AC:L), indicating that the exploit does not require specialized conditions or user interaction beyond standard HTTP requests. Since there is no User Interaction required (UI:N) and the Scope remains Unchanged (S:U), the vulnerability can be triggered remotely by any authenticated low-privilege user who has network reach to the service. The resulting impact on Confidentiality is Low (C:L), which corresponds to a CVSS 3.1 Base Score of 4.3, categorized as Medium severity due to its potential for data leakage without disrupting system operations or altering data integrity.
In terms of threat modeling and adversary behavior, this vulnerability maps directly to the ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials with insufficient privileges to access restricted resources. It also relates to T1530, Data from Cloud Storage Object, if the accessible subset involves stored objects managed by the service. The lack of proper authorization checks allows an attacker to enumerate and retrieve data that should be isolated based on their role or tenant context. This type of flaw is particularly dangerous in multi-tenant environments where one user might inadvertently access another user's data due to flawed logical separation within the REST API implementation.
Mitigation strategies for this vulnerability focus primarily on patching and configuration hardening. Organizations running Oracle REST Data Services versions 24.2.0 through 26.1.0 should apply the latest security patches provided by Oracle immediately to address the authorization flaws in the ADP component. In addition to applying updates, administrators should enforce strict network segmentation to limit HTTP access to only those IP addresses or subnets that require it. Implementing Web Application Firewalls can help detect and block anomalous request patterns associated with data exfiltration attempts. Furthermore, reviewing user roles and permissions within Oracle REST Data Services ensures that low-privileged accounts are granted the minimum necessary access rights, reducing the blast radius if such a vulnerability is exploited in other contexts. Regular auditing of API endpoints for proper authentication and authorization checks is also recommended to prevent similar issues from arising in future updates or custom configurations.