CVE-2026-89121
Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
- State
- Published
- Severity
- 4.7 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 13, 2026
- Reserved
- Sep 10, 2026
Description
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.7 Medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N | sap |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
SAP S/4HANA (Linear Asset Management RAP Business Object)SAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.