CVE-2026-89124: Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)
Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on confidentiality of the data, with no impact on the integrity and availability of the application.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges can exploit the affected functionality. The attack can be performed remotely and does not require user interaction.
What is the likely impact if exploited?
The issue allows access to sensitive information outside the user's intended authorization scope. The stated impact is limited to confidentiality; it does not affect data integrity or application availability.
Is an unauthenticated attacker exposed to this vulnerability?
No. Exploitation requires prior authentication and low-level privileges in the application.