CVE-2025-23188 — Missing Authorization check in SAP S/4HANA (RBD)

CVE-2025-23188

Missing Authorization check in SAP S/4HANA (RBD) PUBLISHED

Description (CNA)

An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions beyond their intended permissions. This causes a low impact on integrity with no impact on confidentiality and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA (RBD)	affected S4CORE 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected EA-FINSERV 618; affected EA-FINSERV 800

CWE

CWE-862

References

https://me.sap.com/notes/3557131
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.