CVE-2026-40133

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, resulting in low impact on the confidentiality and integrity of the data. Additionally, this vulnerability may prevent the legitimate user from accessing the records, causing low impact on application availability.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3718083
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Debido a la falta de verificación de autorización en el Mantenimiento de Condiciones de SAP S/4HANA, un atacante autenticado podría obtener acceso no autorizado para ver y modificar registros de tablas de condiciones, lo que resulta en un bajo impacto en la confidencialidad e integridad de los datos. Además, esta vulnerabilidad podría impedir que el usuario legítimo acceda a los registros, causando un bajo impacto en la disponibilidad de la aplicación.

Information

Published : 2026-05-12 03:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-40133

Mitre link : CVE-2026-40133

CVE.ORG link : CVE-2026-40133

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-40133", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40133", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:14:55.928135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP S/4HANA Condition Maintenance", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-12T03:16:12.177", "references": [{"url": "https://me.sap.com/notes/3718083", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, resulting in low impact on the confidentiality and integrity of the data. Additionally, this vulnerability may prevent the legitimate user from accessing the records, causing low impact on application availability."}, {"lang": "es", "value": "Debido a la falta de verificaci\u00f3n de autorizaci\u00f3n en el Mantenimiento de Condiciones de SAP S/4HANA, un atacante autenticado podr\u00eda obtener acceso no autorizado para ver y modificar registros de tablas de condiciones, lo que resulta en un bajo impacto en la confidencialidad e integridad de los datos. Adem\u00e1s, esta vulnerabilidad podr\u00eda impedir que el usuario leg\u00edtimo acceda a los registros, causando un bajo impacto en la disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "cna@sap.com"}