CVE-2026-91391 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw is classified as a difficult-to-exploit issue that permits unauthenticated attackers to gain unauthorized access to specific subsets of data accessible by the application via HTTP network connections. The core technical nature of this vulnerability aligns with CWE-284, which describes Improper Access Control, indicating that the system fails to properly enforce restrictions on what authenticated or unauthenticated users can do once they connect to the service. Although the attacker does not need valid credentials to initiate the attack vector, the complexity involved in successfully exploiting the flaw suggests a high level of technical skill is required, likely involving precise manipulation of HTTP requests or specific state conditions within the Open UI rendering engine that are not trivially reproducible by automated tools without significant effort.
From an operational perspective, the impact of this vulnerability is primarily confined to confidentiality rather than integrity or availability. The successful exploitation results in unauthorized read access to a limited subset of Siebel CRM data, which corresponds to a Low severity level for Confidentiality impacts as reflected in the CVSS 3.1 scoring model with a base score of 3.7. This means that while sensitive business information such as customer records or internal communications could be exposed, the attacker cannot modify existing data nor disrupt service operations directly through this specific vector. The restriction to network access via HTTP implies that the attack surface is limited to web-facing interfaces, and the requirement for unauthenticated access highlights a failure in initial request validation before any user context is established. This scenario maps closely to ATT&CK technique T1078, specifically Valid Accounts or Default Accounts if default credentials were involved, but more accurately reflects unauthorized data exfiltration through improper authorization checks on API endpoints served by the Open UI framework.
Mitigation strategies for this vulnerability must focus on both immediate technical controls and long-term architectural improvements. Organizations should prioritize applying the latest security patches provided by Oracle to bring their Siebel CRM instances up to a version where these access control flaws have been remediated. In environments where patching is not immediately feasible, network-level mitigations such as Web Application Firewalls can be configured to detect and block anomalous HTTP request patterns associated with this specific exploitation technique. Additionally, implementing strict input validation and enforcing robust authentication mechanisms for all API endpoints exposed by the Open UI component will help prevent unauthenticated access attempts from reaching vulnerable code paths. Regular security assessments and penetration testing focused on authorization bypasses are recommended to identify similar weaknesses in other parts of the CRM infrastructure before they can be leveraged by adversaries seeking to exfiltrate sensitive corporate data.