CVE-2026-76962: Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on availability. There is no impact on confidentiality and integrity.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs low privileges and network access. No user interaction is required.
What can an attacker do if they exploit this issue?
They can send specially crafted requests to delete specific bank-chain entries that should not be accessible to them. The stated impact is limited to low availability impact; confidentiality and integrity are not affected.
What should teams review while remediation is pending?
Review access granted to low-privileged users of the Manage Bank Chains app and monitor for unauthorized deletion of bank-chain entries. The available data does not provide a specific workaround or affected-version list.