CVE-2026-27672
Authorization Bypass in SAP Material Master Allows Sensitive Data Disclosure
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | material_master | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Material Master application where it does not enforce authorization checks for authenticated users when they execute reports.
As a result, users who are authenticated but may not have proper permissions can access sensitive information through these reports.
This means that while users must be logged in, the system fails to verify if they are authorized to view certain data, leading to potential information disclosure.
How can this vulnerability impact me? :
This vulnerability can lead to the disclosure of sensitive information to authenticated users who should not have access to it.
The impact on confidentiality is considered low, and there is no impact on the integrity or availability of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the Material Master application allows authenticated users to execute reports without proper authorization checks, leading to the disclosure of sensitive information. Although the impact on confidentiality is considered low and there is no effect on integrity or availability, any unauthorized disclosure of sensitive data could potentially affect compliance with data protection regulations such as GDPR or HIPAA, which require strict controls on access to personal or sensitive information.
However, the provided information does not explicitly detail the extent of compliance impact or specific regulatory implications.