CVE-2025-26660: Broken Access Control in SAP Fiori apps (Posting Library)
First published: Tue Mar 11 2025(Updated: )
SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Fiori |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-26660?
CVE-2025-26660 is classified as a critical vulnerability due to its potential to allow unauthorized access to sensitive functions.
How do I fix CVE-2025-26660?
To fix CVE-2025-26660, ensure that all security settings within the SAP Fiori applications are properly configured and not left at default values.
Who is affected by CVE-2025-26660?
Organizations using SAP Fiori applications that utilize the posting library are affected by CVE-2025-26660.
What are the potential impacts of CVE-2025-26660?
The potential impacts of CVE-2025-26660 include unauthorized access and manipulation of data within the application due to bypassed access controls.
Is there a patch available for CVE-2025-26660?
Yes, SAP has released security patches that address CVE-2025-26660, and these can be applied to secure the affected applications.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/sap
- canonical/sap fiori