Riskcovery

CVE-2026-40132

Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)

State
Published
Severity
5.4 Medium
Published
May 12, 2026
Updated
May 12, 2026
Reserved
Apr 9, 2026

Read the record on cve.org

Description

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This vulnerability also enables the attacker to change the default settings and modify value fields, which will mislead risk evaluations and falsely lower assessed risk levels. This results in a low impact on the confidentiality and integrity of the data. There is no impact on the application�s availability.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsap

Weaknesses

Affected Products

ProductVersions
SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)SAP_SE
  • SEM-BW 605Affected
  • 700Affected
  • 736Affected
  • 746Affected
  • 747Affected
  • 748Affected
  • 749Affected
  • 800Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.