CVE-2026-89121
Received Received - Intake

SAP S/4HANA Authorization Bypass in Business Object Data

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89121
EUVD
EUVD-2026-98200

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SAP_SE SAP S/4HANA (Linear Asset Management RAP Business Object) S4CORE 109

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP S/4HANA fails to perform proper authorization checks for modifying business object data. An attacker with low privileges and local access can bypass these checks to alter data they are not authorized to change. This primarily affects data integrity.

Impact Analysis

If exploited, this vulnerability could allow unauthorized modifications to critical business data, leading to incorrect financial records, compliance violations, or operational disruptions. Attackers could alter data without needing high-level access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized data alterations, violating integrity requirements. Organizations may face penalties for failing to protect data integrity under these regulations.

Mitigation Strategies

Apply the latest security patches from SAP as referenced in SAP Note 3799621 to address insufficient authorization checks in SAP S/4HANA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89121. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart