{"id":"CVE-2026-34261","state":"PUBLISHED","title":"Missing Authorization check in SAP Business Analytics and SAP Content Management","description":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.","publishedAt":"2026-04-14T00:08:51.232Z","updatedAt":"2026-04-14T13:14:17.473Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"sap"},"assigner":"sap","products":["SAP_SE SAP Business Analytics and SAP Content Management"],"affected":[{"vendor":"SAP_SE","product":"SAP Business Analytics and SAP Content Management","defaultStatus":"unaffected","versions":[{"version":"S4HCMRXX 100","status":"affected"},{"version":"101","status":"affected"},{"version":"102","status":"affected"},{"version":"SAP_HRRXX 600","status":"affected"},{"version":"604","status":"affected"},{"version":"608","status":"affected"}]}],"references":["https://me.sap.com/notes/3705094","https://url.sap/sapsecuritypatchday"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/34xxx/CVE-2026-34261.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-34261","state":"PUBLISHED","datePublished":"2026-04-14T00:08:51.232Z","dateUpdated":"2026-04-14T13:14:17.473Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2026-03-26T19:02:45.983Z"},"containers":{"cna":{"title":"Missing Authorization check in SAP Business Analytics and SAP Content Management","descriptions":[{"lang":"en","value":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability."}],"affected":[{"vendor":"SAP_SE","product":"SAP Business Analytics and SAP Content Management","defaultStatus":"unaffected","versions":[{"version":"S4HCMRXX 100","status":"affected"},{"version":"101","status":"affected"},{"version":"102","status":"affected"},{"version":"SAP_HRRXX 600","status":"affected"},{"version":"604","status":"affected"},{"version":"608","status":"affected"}]}],"references":[{"url":"https://me.sap.com/notes/3705094"},{"url":"https://url.sap/sapsecuritypatchday"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"eng","description":"CWE-862: Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"sap","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateUpdated":"2026-04-14T00:08:51.232Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-34261","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-04-14T12:53:23.140179Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-14T13:14:17.473Z"}}]}}}