Authenticated data tampering and disclosure

Improper access control in Oracle Helidon 3.2.18 allows remote authenticated users to read and modify subset data via HTTP. Oracle has not identified the affected Imperative Web Server handler or the failed authorization check, so the public record does not reveal which request path accepts low-privilege input without proper access enforcement. Exploitation requires valid low-privilege access and network reachability over HTTP, and the published impact is limited to subset data disclosure plus update, insert, or delete operations rather than takeover or service interruption.