← back
CVE-2025-26656

Missing Authorization check in S/4HANA (Manage Purchasing Info Records)

CVSS 4.3 MEDIUMEPSS 0.2%CWE-862
OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
SAP_SE · S/4HANA (Manage Purchasing Info Records)

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://me.sap.com/notes/3474392https://url.sap/sapsecuritypatchday