CVE-2025-42913 — Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)

CVE-2025-42913

Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) PUBLISHED

Description (CNA)

Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP HCM (My Timesheet Fiori 2.0 application)	affected GBX01HR5 605

CWE

CWE-862

References

https://me.sap.com/notes/3635587
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.