CVE-2026-24322
Undergoing Analysis
Undergoing Analysis - In Progress
Authorization Bypass in SAP ST-PI Leads to Data Disclosure
Vulnerability report for CVE-2026-24322, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-02-10
Last updated on: 2026-02-17
Assigner: SAP SE
Description
Description
SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensitive information to be disclosed. This vulnerability has a high impact on confidentiality and does not affect integrity or availability.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | solution_tools_plug-in | 2008_1_700 |
| sap | solution_tools_plug-in | 2008_1_710 |
| sap | solution_tools_plug-in | 740 |
| sap | solution_tools_plug-in | 758 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
