CVE-2025-26660 — Broken Access Control in SAP Fiori apps (Posting Library)

CVE-2025-26660

Broken Access Control in SAP Fiori apps (Posting Library) PUBLISHED

Description (CNA)

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Fiori apps (Posting Library)	affected S4CORE 103; affected 104; affected 105; affected 106; affected 107; affected 108

CWE

CWE-639

References

https://me.sap.com/notes/3557655
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.