CVE-2026-0493
Unknown Unknown - Not Provided

CSRF Vulnerability in SAP Fiori Intercompany Balance Reconciliation

Publication date: 2026-01-13

Last updated on: 2026-01-13

Assigner: SAP SE

Description
Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute state?changing actions using an inappropriate request type, this deviation from expected request semantics may allow an attacker to trigger unintended actions on behalf of an authenticated user causing low impact on integrity of the system. This has no impact on confidentiality and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-01-13
Last Modified
2026-01-13
Generated
2026-07-06
AI Q&A
2026-01-13
EPSS Evaluated
2026-07-05
NVD
CVE-2026-0493
EUVD
EUVD-2026-2384

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap fiori_app_intercompany_balance_reconciliation *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the SAP Fiori App Intercompany Balance Reconciliation. It allows an attacker to perform state-changing actions by sending inappropriate request types that deviate from expected request semantics. Essentially, an attacker can trick an authenticated user into executing unintended actions without their consent.

Compliance Impact

The vulnerability has no impact on confidentiality and availability, and only a low impact on integrity. There is no information provided about its effect on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

The vulnerability can impact the integrity of the system by allowing attackers to trigger unintended actions on behalf of authenticated users. However, it has no impact on confidentiality or availability, and the overall impact is considered low.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0493. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart