CVE-2025-26656: Missing Authorization check in S/4HANA (Manage Purchasing Info Records)
Published Mar 11, 2025
·Updated
OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.
Affected Software
1 affected component
SAP S/4HANA
Event History
Mar 11, 2025
CVE Published
via MITRE·12:35 AM
Data Sourced
via MITRE·12:35 AM
DescriptionSeverity
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-26656?
CVE-2025-26656 is classified with low impact on the integrity of the application.
2
How do I fix CVE-2025-26656?
To mitigate CVE-2025-26656, apply the latest security patches provided by SAP for S/4HANA.
3
What components of SAP S/4HANA are affected by CVE-2025-26656?
CVE-2025-26656 affects the OData Service in Manage Purchasing Info Records.
4
Can CVE-2025-26656 be exploited by authenticated users?
Yes, CVE-2025-26656 allows authenticated users to escalate privileges due to a lack of proper authorization checks.
5
What is the potential impact of exploiting CVE-2025-26656?
Exploiting CVE-2025-26656 can lead to unauthorized access and privilege escalation within the SAP S/4HANA application.