CVE-2025-26660: Broken Access Control in SAP Fiori apps (Posting Library)
SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26660?
CVE-2025-26660 is classified as a critical vulnerability due to its potential to allow unauthorized access to sensitive functions.
How do I fix CVE-2025-26660?
To fix CVE-2025-26660, ensure that all security settings within the SAP Fiori applications are properly configured and not left at default values.
Who is affected by CVE-2025-26660?
Organizations using SAP Fiori applications that utilize the posting library are affected by CVE-2025-26660.
What are the potential impacts of CVE-2025-26660?
The potential impacts of CVE-2025-26660 include unauthorized access and manipulation of data within the application due to bypassed access controls.
Is there a patch available for CVE-2025-26660?
Yes, SAP has released security patches that address CVE-2025-26660, and these can be applied to secure the affected applications.