CVE-2026-91240: Improper access control vulnerability in Oracle WebCenter Sites

A difficult-to-exploit vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated attacker with network access via HTTP to obtain unauthorized access to critical data or all accessible Oracle WebCenter Sites data. The CVSS 3.1 base score is 5.9, with an impact on confidentiality.