Local low-privilege data access and tampering

Access control flaw in Oracle Siebel CRM Cloud Applications 22.3 through 26.6 allows local users to read and modify application data. Oracle identifies the affected component as Siebel Cloud Manager, but public records do not disclose the code path or the access-control operation that grants data access beyond a low-privilege user's intended rights. Exploitation requires low-privilege logon to the host infrastructure and no user interaction; published impact is unauthorized read access to critical data and unauthorized update, insert, or delete access to some accessible data, with scope changed beyond the vulnerable product.