CVE-2026-34261

Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3705094
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Debido a una comprobación de autorización faltante en SAP Business Analytics y SAP Content Management, un usuario autenticado podría realizar llamadas no autorizadas a ciertos módulos de función remotos, potencialmente accediendo a información sensible más allá de sus permisos previstos. Esta vulnerabilidad afecta la confidencialidad, sin impacto en la integridad y disponibilidad.

Information

Published : 2026-04-14 01:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34261

Mitre link : CVE-2026-34261

CVE.ORG link : CVE-2026-34261

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-34261", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34261", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T12:53:23.140179Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business Analytics and SAP Content Management", "versions": [{"status": "affected", "version": "S4HCMRXX 100"}, {"status": "affected", "version": "101"}, {"status": "affected", "version": "102"}, {"status": "affected", "version": "SAP_HRRXX 600"}, {"status": "affected", "version": "604"}, {"status": "affected", "version": "608"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-14T01:16:03.897", "references": [{"url": "https://me.sap.com/notes/3705094", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability."}, {"lang": "es", "value": "Debido a una comprobaci\u00f3n de autorizaci\u00f3n faltante en SAP Business Analytics y SAP Content Management, un usuario autenticado podr\u00eda realizar llamadas no autorizadas a ciertos m\u00f3dulos de funci\u00f3n remotos, potencialmente accediendo a informaci\u00f3n sensible m\u00e1s all\u00e1 de sus permisos previstos. Esta vulnerabilidad afecta la confidencialidad, sin impacto en la integridad y disponibilidad."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "cna@sap.com"}