CVE-2026-91528 in BI Publisher
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting version 12.2.1.4.0 of the Oracle BI Publisher product. This security flaw is classified as an easily exploitable issue that permits a low-privileged attacker to compromise the integrity and confidentiality of the system. The attack vector requires network access via HTTPS, indicating that the vulnerability can be leveraged remotely without physical proximity or local account privileges on the target machine. The requirement for low privilege means that even users with minimal initial access rights within the BI Publisher environment can exploit this flaw, significantly lowering the barrier to entry for malicious actors who may have gained foothold through other means such as phishing or weak credential management.
The technical nature of this vulnerability centers around an authorization bypass mechanism inherent in how certain data requests are processed by the BI Platform Security module. When a user with low privileges submits specific queries or navigates particular sections of the application, the system fails to adequately validate whether the requesting entity has sufficient rights to access the targeted subset of data. This logic error allows the attacker to retrieve information that should be restricted based on their assigned role and permissions profile. The flaw does not involve buffer overflows or code injection but rather a failure in implementing proper access control checks, which is a common pattern in enterprise web applications where complex permission hierarchies are managed dynamically.
The operational impact of this vulnerability is primarily focused on the confidentiality aspect of the security triad, as indicated by the CVSS 3.1 base score of 4.3 and the vector string C:L I:N A:N. Successful exploitation results in unauthorized read access to a subset of Oracle BI Publisher accessible data. This means that sensitive business intelligence reports, dashboards, or underlying database queries intended for higher-privileged users can be viewed by lower-level employees or external attackers who have compromised low-tier accounts. While there is no direct impact on system integrity or availability, the exposure of proprietary data can lead to significant competitive disadvantage, regulatory non-compliance, and potential further lateral movement within an organization if the retrieved data contains credentials or network topology information.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization in industry standards such as MITRE Common Weakness Enumeration. The exploitation method corresponds to techniques found in the ATT&CK framework under Initial Access via Valid Accounts or Discovery through Data Retrieval, depending on whether the attacker is using stolen credentials or exploiting a service account with limited scope. Understanding these mappings helps security teams contextualize the risk within broader threat landscapes and prioritize remediation efforts based on established best practices for access control hardening.
Mitigation strategies should focus immediately on applying the latest patches provided by Oracle to update the BI Publisher component to a version where this authorization logic has been corrected. In addition to patching, organizations should enforce strict least-privilege principles across all user accounts within the BI environment. Regular audits of role-based access controls are essential to ensure that users only have permissions necessary for their specific job functions. Network segmentation can also reduce risk by limiting HTTPS access to the BI Publisher interface to trusted subnets or requiring multi-factor authentication for administrative and high-risk data queries, thereby adding layers of defense even if a low-privilege account is compromised.