CVE-2026-0497
Authenticated Information Disclosure in SAP Product Designer Web UI
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | product_designer_web_ui | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated non-administrative users to access non-sensitive information, resulting in a low impact on confidentiality and no impact on integrity or availability. Given that only non-sensitive information is accessible, the impact on compliance with common standards and regulations such as GDPR or HIPAA is likely minimal or negligible.
Can you explain this vulnerability to me?
This vulnerability in SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. It does not affect the integrity or availability of the application and has a low impact on confidentiality.
How can this vulnerability impact me? :
The impact of this vulnerability is low, as it only allows access to non-sensitive information by authenticated non-administrative users. There is no impact on the integrity or availability of the application.