CVE-2026-89121
published 2026-10-13CVE-2026-89121: SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker…
PriorityP424medium4.7CVSS 3.1
AVLACHPRLUINSUCNIHAN
EPSS
0.09%
0.5th percentile
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_s_4hana | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data.
ghsa_unreviewed·2026-10-13
CVE-2026-89121 [MEDIUM] CWE-862 SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data.
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.
VulDB
SAP S4HANA 4CORE 109 improper authorization
vuldb·2026-10-13·CVSS 4.7
CVE-2026-89121 [MEDIUM] SAP S4HANA 4CORE 109 improper authorization
A vulnerability classified as problematic has been found in SAP S4HANA 4CORE 109. This impacts an unknown function. The manipulation leads to improper authorization.
This vulnerability is uniquely identified as CVE-2026-89121. Local access is required to approach this attack. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-13
Published