CVE-2026-0486 - Missing Authorization Check in ABAP based SAP systems

Back Back to CVE browser

MEDIUM

Missing Authorization Check in ABAP based SAP systems

Published Feb 10, 2026

5.0

MEDIUM

CVSS 3.1

EPSS 0.18%

Description

In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.

Affected products

Vendor SAP SE Product ABAP based SAP systems Default
unaffected
- Version
  2008_1_710
  Status
  affected
  Constraints
  -
- Version
  740
  Status
  affected
  Constraints
  -
- Version
  758
  Status
  affected
  Constraints
  -
- Version
  ST-PI 2005_1_700
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

ABAP based SAP systems

unaffected

Version	Status	Constraints
2008_1_710	affected	-
740	affected	-
758	affected	-
ST-PI 2005_1_700	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6873
Advisory
https://me.sap.com/notes/3691645
Permissions Required
https://url.sap/sapsecuritypatchday
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6873		Advisory
https://me.sap.com/notes/3691645		Permissions Required
https://url.sap/sapsecuritypatchday		Vendor Advisory