CVE-2026-91476 in PeopleSoft Enterprise FIN Common Objects Brazil
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil, specifically affecting version 9.1. This security flaw is characterized by an unauthenticated attacker's ability to exploit a weakness in how the application handles incoming HTTP requests. The core technical issue involves insufficient access control mechanisms or improper validation of user privileges when processing data retrieval operations through the web interface. Because the vulnerability allows for exploitation without prior authentication, it represents a significant breach in the principle of least privilege and proper identity verification protocols that are fundamental to secure enterprise resource planning systems.
From an operational perspective, this flaw enables unauthorized read access to a specific subset of data accessible by PeopleSoft Enterprise FIN Common Objects Brazil. The impact is primarily confined to confidentiality, as indicated by the CVSS 3.1 base score of 5.3 and the vector string which shows no impact on integrity or availability. This means that while an attacker cannot modify system configurations or disrupt service uptime, they can extract sensitive financial data, procurement records, or other confidential information stored within the affected module. The ability to read this data without authentication suggests a failure in session management or API endpoint security controls, allowing external actors to query internal databases directly through crafted HTTP requests.
This vulnerability aligns with CWE-284, which describes Improper Access Control, and specifically relates to CWE-732, where the system does not perform sufficient authorization checks before granting access to resources. In terms of offensive cybersecurity frameworks such as MITRE ATT&CK, this behavior is consistent with techniques used in Initial Access or Discovery phases, particularly those involving exploitation of web applications for data exfiltration. The lack of authentication requirement places it in a high-risk category despite the limited scope of impact, as automated scanning tools can easily identify and exploit such endpoints to gather intelligence on an organization's financial structure and operational details.
Mitigation strategies must focus on immediate remediation through vendor-provided patches or updates that address the specific flaw in the eProcurement component. Organizations running version 9.1 should prioritize applying the latest security fixes released by Oracle for PeopleSoft Enterprise FIN Common Objects Brazil. In addition to patching, implementing network-level controls such as Web Application Firewalls can help mitigate risk by filtering malicious HTTP requests before they reach the application server. It is also advisable to review and harden access control policies within the eProcurement module, ensuring that all data retrieval endpoints require valid authentication tokens and adhere to strict role-based access controls. Regular vulnerability assessments should be conducted to detect similar misconfigurations in other parts of the PeopleSoft environment.