Authenticated data compromise via undisclosed Composer flaw

Improper access control in Composer in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows remote authenticated users to modify data via HTTP. Oracle and NVD identify the Composer component but do not disclose the affected endpoint, request, or validation failure, so the public record does not reveal which operation improperly authorizes attacker-controlled actions. Low-privileged application access is required and Oracle rates exploitation as high complexity; successful use grants unauthorized create, delete, or modify access to critical data, read access to a subset of accessible data, and partial service interruption.