CVE-2026-109808: Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)
Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Can an unauthenticated remote attacker exploit this issue?
No. Exploitation requires an authenticated attacker with the necessary access to invoke the affected remote-enabled functionality.
What additional information does an attacker need to target the affected functionality?
The attacker must have prior knowledge of specific internal identifiers. Exploitation is only possible when those conditions are met.
What is the expected security impact if exploitation succeeds?
An attacker may read sensitive information that would otherwise be restricted. The issue has no stated impact on data integrity or availability.