CVE-2026-27679
Authorization Bypass in SAP S/4HANA OData Service Risks Data Integrity
Publication date: 2026-04-14
Last updated on: 2026-05-04
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | manage_reference_structures | uis4h_109 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists due to missing authorization checks in the SAP S/4HANA frontend OData Service called Manage Reference Structures. Because of this flaw, an attacker who has some level of access could update or delete child entities through the exposed OData services without having the proper authorization.
The vulnerability primarily impacts data integrity, meaning unauthorized changes can be made to data. However, it does not affect confidentiality or availability.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to modify or delete child entities in your SAP S/4HANA system without proper authorization. This compromises the integrity of your data, potentially leading to incorrect or lost information.
Since confidentiality and availability are not impacted, the risk is focused on unauthorized data alteration rather than data exposure or system downtime.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability impacts the integrity of data by allowing unauthorized updates and deletions of child entities via exposed OData services in SAP S/4HANA. While confidentiality and availability are not affected, the integrity impact could lead to non-compliance with standards and regulations that require strict data integrity controls, such as GDPR and HIPAA.
Specifically, regulations like GDPR and HIPAA mandate that data must be accurate and protected against unauthorized alteration. The missing authorization checks could result in unauthorized data modification, potentially violating these requirements and leading to compliance issues.