CVE-2026-89121
4.7MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862
Impact
Authenticated local attackers with low privileges can bypass authorization to modify business object data they shouldn't have access to. They require existing local access and an authenticated low-privilege account on the SAP system.
Root cause
SAP S/4HANA lacks proper instance-level authorization checks on certain modification operations for associated business objects.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Implement SAP Note 3799621 to apply the missing authorization checks. No interim mitigation is provided; restrict untrusted user access to the SAP instance until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.