CVE-2026-27672

The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information. This vulnerability has a low impact on confidentiality and does not affect integrity and availability of the system.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3703276
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) La aplicación Material Master no aplica controles de autorización para usuarios autenticados al ejecutar informes, lo que resulta en la divulgación de información sensible. Esta vulnerabilidad tiene un bajo impacto en la confidencialidad y no afecta la integridad y disponibilidad del sistema.

Information

Published : 2026-04-14 00:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-27672

Mitre link : CVE-2026-27672

CVE.ORG link : CVE-2026-27672

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-27672", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27672", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T12:57:05.976905Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "Material Master Application", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}, {"status": "affected", "version": "SCM_BASIS 700"}, {"status": "affected", "version": "SCM_BASIS 701"}, {"status": "affected", "version": "SCM_BASIS 702"}, {"status": "affected", "version": "SCM_BASIS 712"}, {"status": "affected", "version": "SCM_BASIS 713"}, {"status": "affected", "version": "SCM_BASIS 714"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-14T00:16:05.297", "references": [{"url": "https://me.sap.com/notes/3703276", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information. This vulnerability has a low impact on confidentiality and does not affect integrity and availability of the system."}, {"lang": "es", "value": "La aplicaci\u00f3n Material Master no aplica controles de autorizaci\u00f3n para usuarios autenticados al ejecutar informes, lo que resulta en la divulgaci\u00f3n de informaci\u00f3n sensible. Esta vulnerabilidad tiene un bajo impacto en la confidencialidad y no afecta la integridad y disponibilidad del sistema."}], "lastModified": "2026-10-26T00:10:00.150", "sourceIdentifier": "cna@sap.com"}