Low-privilege data access and modification

Authorization bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets remote authenticated users read and modify data via HTTP. Oracle identifies the affected locus as the Endeca Application Controller but has not disclosed the specific request path or authorization check that mishandles attacker-controlled input or state. Exploitation requires a low-privileged account, HTTP reachability, and separate user interaction; the published impact is unauthorized read access to critical data and unauthorized update, insert, or delete access to some accessible data.