CVE-2026-89108: Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments of SAP Manufacturing Integration and Intelligence using the Configuration Service are exposed where an attacker can act with MII administrator privileges. The issue is in certain administrative functionality, so it is not described as exploitable by an unauthenticated or low-privileged user.
What does an attacker need to exploit it?
The attacker needs MII administrator privileges and must submit a specially crafted request. No user interaction is required.
What could successful exploitation lead to?
An attacker could provision an account with elevated privileges on the underlying Java application server and gain administrative control of that underlying system. This can affect confidentiality, integrity, and availability beyond the MII application itself.