Riskcovery

CVE-2025-26660

Broken Access Control in SAP Fiori apps (Posting Library)

State
Published
Severity
4.3 Medium
Published
Mar 11, 2025
Updated
Mar 11, 2025
Reserved
Feb 12, 2025

Read the record on cve.org

Description

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsap

Weaknesses

  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
SAP Fiori apps (Posting Library)SAP_SE
  • S4CORE 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.