CVE-2026-66764 — Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items)

CVE-2026-66764

Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) PUBLISHED

Description (CNA)

Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4 HANA (Reprocess Bank Statement Items)	affected S4CORE 104; affected 105; affected 106; affected 107; affected 108; affected 109

CWE

CWE-639

References

https://me.sap.com/notes/3669608
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.