CVE-2026-24312

Missing authorization check in SAP Business Workflow

State: Published
Severity: 5.2 Medium
Published: Feb 10, 2026
Updated: Feb 10, 2026
Reserved: Jan 21, 2026

Description

An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high impact on data integrity, with low impact on confidentiality and no impact on availability of the application.

Scores

CVSS	Score	Vector	Source
3.1	5.2 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N	sap

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
SAP Business WorkflowSAP_SE	SAP_BASIS 752Affected SAP_BASIS 753Affected SAP_BASIS 754Affected SAP_BASIS 755Affected SAP_BASIS 756Affected SAP_BASIS 757Affected SAP_BASIS 758Affected SAP_BASIS 816Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.