CVE-2026-83313 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting the Oracle BI Publisher product across supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0. This security flaw represents a critical weakness in the authentication or authorization mechanisms that govern access to sensitive reporting data. The nature of this vulnerability allows for exploitation by an attacker who possesses only low-level privileges, significantly lowering the barrier to entry compared to vulnerabilities requiring administrative rights. Furthermore, the attack vector is network-based via HTTP, meaning remote attackers can exploit this flaw without any need for physical proximity or local system access, provided they have valid credentials at a basic user level and network connectivity to the BI Publisher instance.
The technical execution of this vulnerability likely involves manipulating request parameters or session states to bypass intended security controls, leading to an unauthorized elevation of privileges within the application context. Although the initial foothold is gained through low-privileged access, the consequence is a scope change where the attacker can traverse beyond their designated permissions. This behavior aligns with CWE-269, which classifies Improper Privilege Management, and potentially CWE-862, Missing Authorization, as the system fails to enforce proper restrictions on what data an authenticated user can view or modify. The vulnerability enables the extraction of critical business intelligence reports, financial summaries, and other sensitive datasets that are typically restricted from lower-tier users.
The operational impact of this compromise is severe due to the high confidentiality impact indicated by a CVSS 3.1 Base Score of 7.7. Successful exploitation results in complete access to all Oracle BI Publisher accessible data for the compromised account or potentially broader if session hijacking techniques are employed. This leads to significant exposure of proprietary information, customer details, and internal metrics that could be leveraged for further attacks such as social engineering or competitive intelligence gathering. From a threat actor perspective, this aligns with MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials to move laterally or exfiltrate data without triggering typical intrusion detection alerts associated with brute-force or credential stuffing attempts.
Mitigation strategies must prioritize immediate patching of the Oracle BI Publisher software to the latest security update provided by Oracle for all affected versions. Organizations should also implement strict network segmentation to limit HTTP access to the BI Platform Security component, ensuring it is not directly exposed to untrusted networks without additional protective layers such as Web Application Firewalls configured with rules specific to this vulnerability pattern. Additionally, enforcing multi-factor authentication and reviewing user privilege assignments can reduce the risk of exploitation by low-privileged accounts. Regular audits of access logs should be conducted to detect anomalous data retrieval patterns that may indicate successful exploitation of this flaw before it leads to significant data loss or regulatory non-compliance.