Description
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.
Published: 2026-10-13
Score: 4.7 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.
Title Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-10-13T00:27:19.731Z

Reserved: 2026-09-10T22:25:18.639Z

Link: CVE-2026-89121

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T01:16:48.990

Modified: 2026-10-13T01:16:48.990

Link: CVE-2026-89121

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses