CVE-2026-34261
Authorization Bypass in SAP Analytics and Content Management
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | business_analytics | * |
| sap | content_management | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability affects confidentiality by allowing an authenticated user to access sensitive information beyond their intended permissions due to a missing authorization check.
Such unauthorized access to sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls to protect personal and sensitive information.
Can you explain this vulnerability to me?
This vulnerability exists due to a missing authorization check in SAP Business Analytics and SAP Content Management. It allows an authenticated user to make unauthorized calls to certain remote function modules.
As a result, the user could potentially access sensitive information beyond their intended permissions.
How can this vulnerability impact me? :
The vulnerability impacts confidentiality by potentially allowing unauthorized access to sensitive information.
There is no impact on data integrity or system availability.