Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-24321

Information Disclosure vulnerability in SAP Commerce Cloud

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP Commerce Cloud

Default version status: unaffected

  • HY_COM 2205affected
  • COM_CLOUD 2211affected
  • 2211-JDK21affected

References