MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2026-27679

CVSS 6.5v3.1pub. 2026-04-14upd. 2026-05-04

Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

  • Sap Manage Reference Structures

    APP
    Sap
    uis4h_109

  • Sap S\/4hana

    APP
    Sap
    all versions
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2026-0488CRITICAL9.9PL ✓same product

SAP CRM / S/4HANA Scripting Editor — nieautoryzowane wykonanie SQL

CVE-2022-22531HIGH8.1same product

The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does ...

CVE-2022-22530HIGH8.1same product

The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does ...

CVE-2021-38176HIGH8.8same product

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call N...

CVE-2026-34264MEDIUM6.5same product

W trakcie kontroli autoryzacji w SAP Human Capital Management dla SAP S/4HANA system zwraca konkretne komunika...