CVE-2026-66764

Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3669608
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Reprocesar Partidas de Extracto Bancario en SAP S/4H4NA no realiza las comprobaciones de autorización necesarias para usuarios autenticados, permitiéndoles usar reglas que no han sido compartidas con ellos, lo que resulta en una escalada de privilegios. Esta vulnerabilidad tiene un bajo impacto en la confidencialidad, sin impacto en la integridad y disponibilidad de la aplicación.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66764

Mitre link : CVE-2026-66764

CVE.ORG link : CVE-2026-66764

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-66764", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66764", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:16:55.997039Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP S/4 HANA (Reprocess Bank Statement Items)", "versions": [{"status": "affected", "version": "S4CORE 104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:23.120", "references": [{"url": "https://me.sap.com/notes/3669608", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application"}, {"lang": "es", "value": "Reprocesar Partidas de Extracto Bancario en SAP S/4H4NA no realiza las comprobaciones de autorizaci\u00f3n necesarias para usuarios autenticados, permiti\u00e9ndoles usar reglas que no han sido compartidas con ellos, lo que resulta en una escalada de privilegios. Esta vulnerabilidad tiene un bajo impacto en la confidencialidad, sin impacto en la integridad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cna@sap.com"}