CVE-2026-91431 in Siebel CRM End User
Summary
by MITRE • 10/21/2026
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM End User executes to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Open UI component of Oracle Siebel CRM, specifically affecting end-user versions ranging from 17.0 through 26.9. This security flaw represents a significant risk to organizations relying on this enterprise customer relationship management platform for critical business operations. The core issue stems from insufficient access control mechanisms or improper validation processes within the Open UI layer, which serves as the primary interface between end-users and the underlying Siebel CRM data structures. Because Open UI is responsible for rendering user interfaces dynamically based on server-side logic and client-side scripts, any weakness in how it handles authenticated sessions can lead to severe information disclosure. The vulnerability allows an attacker who has already obtained valid credentials and logged into the infrastructure where Siebel CRM End User executes to exploit this flaw without requiring additional interaction from other users or complex social engineering tactics.
From a technical perspective, the exploitation of this vulnerability requires low-privileged access within the target environment. This means that even standard end-users with basic permissions can leverage the defect to escalate their effective privileges regarding data visibility. The attacker does not need user interface interactions such as clicking malicious links or opening specific files, indicating that the exploit is likely triggered through automated requests or direct manipulation of API endpoints exposed by the Open UI framework once authentication is established. This characteristic aligns with common patterns seen in broken access control vulnerabilities where session tokens or request parameters are manipulated to bypass intended data isolation boundaries. The absence of a user interface requirement for exploitation makes this vulnerability particularly dangerous, as it can be automated and scaled across multiple compromised accounts within an organization.
The operational impact of successfully exploiting this vulnerability is severe, primarily centered around the compromise of confidentiality. According to the provided CVSS 3.1 vector, the attack results in high confidence that critical data will be exposed while integrity and availability remain unaffected. This implies that attackers can read sensitive customer information, financial records, or proprietary business strategies stored within the Siebel CRM database but cannot alter or delete this data nor disrupt service operations directly through this specific flaw. The ability to access all Siebel CRM End User accessible data means that a single compromised low-privileged account could serve as an entry point for comprehensive data exfiltration. This poses significant regulatory and compliance risks, particularly under frameworks such as GDPR, HIPAA, or PCI-DSS, where unauthorized access to personal or financial data triggers strict reporting requirements and potential legal penalties.
In terms of industry-standard classification, this vulnerability is best categorized under CWE-284 Improper Access Control or potentially CWE-613 Insufficient Session Expiration if the issue relates to session management within Open UI. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, as exploitation relies on legitimate credentials obtained through prior compromise or theft. The lateral movement potential is limited by the low privilege requirement but the data access scope is broad, making it a critical concern for internal threat models where insider threats or compromised employee accounts are considered vectors of attack. Organizations must recognize that even users with minimal functional permissions can pose a substantial risk to data confidentiality if such application-level flaws exist in their primary business applications.
Mitigation strategies should focus on immediate patching and enhanced monitoring. Oracle has likely released patches for this vulnerability, so applying the latest security updates to all Siebel CRM instances within the supported version range is the most effective remediation step. In environments where patching cannot be performed immediately due to operational constraints, network segmentation can help isolate the Siebel CRM infrastructure from less trusted networks or user segments. Implementing strict web application firewall rules that monitor for anomalous request patterns associated with data exfiltration may also provide a layer of defense. Furthermore, organizations should enforce multi-factor authentication and regular credential rotation to reduce the likelihood of attackers obtaining valid low-privileged accounts in the first place. Continuous monitoring of access logs for unusual data retrieval activities by standard users is essential to detect potential exploitation attempts early.