CVE-2026-89124
4.3MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Authenticated low-privileged users can access sensitive customs and product catalog data beyond their permissions. An attacker only needs basic network access and standard user credentials to reach the application.
Root cause
The application fails to perform proper authorization checks on specific functions within the customs declaration product catalog.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Apply SAP Security Note 3810872 from the SAP Launchpad. If immediate patching is not possible, restrict network access to the application or revoke access permissions for non-essential users.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on confidentiality of the data, with no impact on the integrity and availability of the application.