OPERA PMS: critical access-control flaw (CVE-2023-22087)
An authentication flaw in OPERA 5 Property Services lets a low-privileged attacker over HTTP take full control of the PMS. Patched since October 2023.
Who is affected
- Oracle OPERA 5 Property Services, version 5.6 and earlier
- Any hotel exposing the OPERA interface on the network, including behind a back-office VPN
- Chains replicating the infrastructure of a partner or acquired brand
How to fix
Apply the fix from Oracle's October 2023 Corrective Security Update or the corrected version supplied by Oracle. Meanwhile, isolate the OPERA interface in a dedicated segment, remove direct internet exposure, and log administrative connections. Verify with your integrator that the patch is deployed across all properties, including recently acquired ones.
What happened
CVE-2023-22087 affects OPERA 5 Property Services, Oracle's hotel management suite, deployed in tens of thousands of properties worldwide. Oracle's CNA advisory describes a flaw that is easily exploitable by a low-privileged attacker with network access via HTTP, resulting in complete takeover of the product: confidentiality, integrity and availability. CISA's ADP analysis classifies the defect as missing authentication for a critical function, CWE-306.
In plain terms: once the entry point is reached, the attacker drives the PMS. And the PMS holds guest records, rates, folios, rooming-list keys sent to chains and often the paths toward payment systems. That is why HotelSec rates this flaw critical for hospitality even though the raw CVSS score stops at 8.8.
Why it matters for a hotel
- The PMS is the central system of the property: a takeover feeds large-scale guest data theft and account fraud directly.
- Automatic chain uploads (profile ID, folio ID) let an attack on one brand travel from property to property without further interaction.
- Many properties rely on an integrator or managed provider for patching: a published fix only counts if it is applied everywhere.
Who is affected
- Oracle OPERA 5 Property Services 5.6 and earlier unpatched versions.
- Environments where the OPERA interface remains reachable from wide networks (extended back office, poorly segmented VPN, partner access).
How to fix
- Deploy the patch from Oracle's October 2023 CPU or the corrected version named in the advisory.
- Get written confirmation from the integrator, property by property.
- Segment: the OPERA interface must be reachable only from the strictly necessary network, never from the internet.
- Log and monitor administrative connections to the PMS, including service profiles.
Context
The pattern is not Oracle-specific: self-hosted or hybrid PMS remain among the most targeted assets in hospitality, because they aggregate the most data with rarely the freshest security controls. CERT teams recommend the same triage for every hospitality package: network exposure first, patch second.