Riskcovery

CVE-2026-0503

Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)

State
Published
Severity
6.4 Medium
Published
Jan 13, 2026
Updated
Jan 13, 2026
Reserved
Dec 9, 2025

Read the record on cve.org

Description

Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can access, modify or delete certain change pointer information within EHS objects in the application which might further affect the subsequent systems. This vulnerability leads to a low impact on confidentiality and integrity of the application with no affect on the availability.

Scores

CVSSScoreVectorSource
3.16.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:Nsap

Weaknesses

Affected Products

ProductVersions
SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)SAP_SE
  • SAP_APPL 618Affected
  • S4CORE 102Affected
  • 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • 109Affected
  • EA-APPL 605Affected
  • 606Affected
  • 617Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.