CVE-2025-42891: Missing Authorization check in SAP Enterprise Search for ABAP

Published Dec 9, 2025

Updated

Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on application's availability.

Affected Software

1 affected component

SAP Enterprise Search for ABAP

Event History

Dec 9, 2025

CVE Published

via MITRE·02:15 AM

Data Sourced

via MITRE·02:15 AM

DescriptionSeverity

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-42891?

CVE-2025-42891 is considered to have a high impact on data confidentiality but a low impact on data integrity.

How do I fix CVE-2025-42891?

To fix CVE-2025-42891, ensure that all necessary authorization checks are implemented for accessing database tables in SAP Enterprise Search for ABAP.

Who is affected by CVE-2025-42891?

CVE-2025-42891 affects users of SAP Enterprise Search for ABAP, particularly those with high privileges.

Can CVE-2025-42891 lead to data leaks?

Yes, CVE-2025-42891 can lead to data leaks as attackers may exploit it to read and export sensitive database content.

What are the implications of CVE-2025-42891 for organizations?

Organizations using SAP Enterprise Search for ABAP should address CVE-2025-42891 promptly to mitigate risks to data confidentiality.