Thousands of Oracle NetSuite ERP websites found to be leaking private customer information

Researchers have discovered a vulnerability in Oracle Netsuite's SuiteCommerce e-commerce platform that could allow threat actors to steal sensitive data from websites.

An AppOmni report revealed that the vulnerability stems from misconfigured access controls in SuiteCommerce instances, specifically within custom record types (CRTs) – tables created by SuiteCommerce enterprise customers.