CVE-2026-0495
Arbitrary Email Sending Vulnerability in SAP Fiori App
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | fiori_app_intercompany_balance_reconciliation | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary email addresses. This capability could be exploited to conduct effective phishing campaigns. The impact on confidentiality, integrity, and availability of the application is considered low.
How can this vulnerability impact me? :
If exploited, this vulnerability could enable attackers with high privileges to send files to arbitrary emails, potentially facilitating phishing attacks. This could lead to users receiving malicious emails appearing to come from a trusted source, increasing the risk of social engineering attacks. However, the direct impact on the application's confidentiality, integrity, and availability is low.