CVE-2026-0493 — Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)

Description (CNA)

Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute state?changing actions using an inappropriate request type, this deviation from expected request semantics may allow an attacker to trigger unintended actions on behalf of an authenticated user causing low impact on integrity of the system. This has no impact on confidentiality and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Fiori App (Intercompany Balance Reconciliation)	affected UIAPFI70 500; affected 600; affected 700; affected 800; affected 900; affected 901; affected 902; affected S4CORE 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected 109; affected UIS4H 109

CWE

CWE-352

References

https://me.sap.com/notes/3655229
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.