Low-privileged data exposure and partial DoS

Access control flaw in Oracle Commerce Experience Manager 11.4.0 lets remote authenticated users read data and cause partial DoS via HTTP. Oracle has not disclosed the vulnerable endpoint or code path; the public record only shows that Experience Manager incorrectly restricts a low-privileged account's access to protected data or operations. Exploitation requires valid low-privileged HTTP access to Experience Manager 11.4.0, and the published impact is limited to unauthorized data access and partial availability loss rather than code execution or full system takeover.