CVE-2026-89124
Received Received - Intake

Display Product Catalog Based on Customs Declaration Information Exposure

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on confidentiality of the data, with no impact on the integrity and availability of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89124
EUVD
EUVD-2026-98202

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SAP_SE SAP HANA (Display Product Catalog Based on Customs Declaration) GTSCORE 200
SAP_SE SAP HANA (Display Product Catalog Based on Customs Declaration) 300

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an application called Display Product Catalog Based on Customs Declaration. It fails to properly check user permissions, allowing low-privileged authenticated users to access sensitive information they should not be able to see. The impact is limited to confidentiality, with no effect on data integrity or availability.

Impact Analysis

An attacker with low privileges could access sensitive data they are not authorized to see. This could lead to unauthorized disclosure of confidential information, though the attacker cannot modify or delete data or disrupt the application.

Compliance Impact

This vulnerability may violate compliance requirements like GDPR or HIPAA by allowing unauthorized access to sensitive data. Organizations must ensure proper authorization controls to meet regulatory standards for data protection and access control.

Mitigation Strategies

Apply the official patch or update from SAP as referenced in SAP Note 3810872 to address insufficient authorization checks in the Display Product Catalog Based on Customs Declaration application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89124. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart