Advisoriesby IbisSAPCVE-2026-44770
SAP S/4 HANA (Create Single Payment): missing authorization
No fix yet
SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| SAP S/4 HANA (Create Single Payment) Product | <= S4CORE 102 | No fix yet |
| <= 103 | No fix yet | |
| <= 104 | No fix yet | |
| <= 105 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-862