Riskcovery

CVE-2025-42876

Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)

State
Published
Severity
7.1 High
Published
Dec 9, 2025
Updated
Dec 9, 2025
Reserved
Apr 16, 2025

Read the record on cve.org

Description

Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could result in a high impact to confidentiality and a low impact to integrity, while availability remains unaffected.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:Nsap

Weaknesses

  • CWE-405 Asymmetric Resource Consumption

Affected Products

ProductVersions
SAP S/4 HANA Private Cloud (Financials General Ledger)SAP_SE
  • S4CORE 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • 109Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.