Riskcovery

CVE-2026-34256

Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)

State
Published
Severity
7.1 High
Published
Apr 14, 2026
Updated
Apr 14, 2026
Reserved
Mar 26, 2026

Read the record on cve.org

Description

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Hsap

Weaknesses

Affected Products

ProductVersions
SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)SAP_SE
  • SAP_FIN 618Affected
  • 720Affected
  • 730Affected
  • EA-FIN 617Affected
  • 700Affected
  • SAPSCORE 135Affected
  • S4CORE 102Affected
  • 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • 109Affected
  • EA-APPL 600Affected
  • 602Affected
  • 603Affected
  • 604Affected
  • 605Affected
  • 606Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.