CVE-2026-44771
published 2026-07-14CVE-2026-44771: SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.28%
19.5th percentile
SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_s_4hana | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privilege
ghsa_unreviewed·2026-07-14
CVE-2026-44771 [MEDIUM] CWE-862 SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privilege
SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.
VulDB
SAP S/4HANA 4CORE 108 Draft operation improper authorization
vuldb·2026-07-14·CVSS 4.3
CVE-2026-44771 [MEDIUM] SAP S/4HANA 4CORE 108 Draft operation improper authorization
A vulnerability has been found in SAP S and 4HANA 4CORE 108 and classified as problematic. This vulnerability affects unknown code of the component Draft operation. The manipulation leads to improper authorization.
This vulnerability is uniquely identified as CVE-2026-44771. The attack is possible to be carried out remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published