CVE-2026-0497 — Missing Authorization check in Business Server Pages Application (Product Designer Web UI)

CVE-2026-0497

Missing Authorization check in Business Server Pages Application (Product Designer Web UI) PUBLISHED

Description (CNA)

SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low impact on confidentiality, with no impact on integrity or availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / Business Server Pages Application (Product Designer Web UI)	affected SAP_APPL 618; affected S4CORE 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected 109; affected EA-APPL 600; affected 602; affected 603; affected 604; affected 605; affected 606; affected 617

CWE

CWE-862

References

https://me.sap.com/notes/3677111
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.