Authenticated data tampering and service interruption

Improper access control in Oracle Warehouse Management 12.2.3 through 12.2.15 allows remote authenticated users to modify data via HTTP. Oracle places the flaw in the Internal Operations component but has not disclosed the affected endpoint or the operation that mishandles a low-privileged user's request, so the specific code path remains unknown. Reachability requires valid low-privileged application credentials over the network; successful attacks can alter or delete Warehouse Management data and cause a partial service interruption, with no published evidence of confidentiality impact.