Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-27678

Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP S/4HANA Backend OData Service (Manage Reference Structures)

Default version status: unaffected

  • S4CORE 109affected

References