CVE-2026-0502

Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform

View on CVE.org
Published May 12, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send unintended requests to the web server. This has low impact on integrity and availability of the application. There is no impact on confidentiality of the data.

Analysis

AI-generated

Technical impact

The vulnerability is an insufficient CSRF protection in the SAP BusinessObjects Business Intelligence Platform. An attacker could trick an authenticated user into sending unintended requests to the web server. The impact is limited to integrity and availability, with no effect on confidentiality.

Affected Systems

The affected platform is SAP BusinessObjects Business Intelligence Platform, as identified by SAP SE. Specific version details are not listed in the current entry.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity. EPSS information is not available, and the issue is not currently listed in the CISA KEV catalog. The likely attack vector is through web‑based, cross‑site requests where an authenticated user’s session is exploited, requiring the victim to be logged in and authorized to perform the desired actions.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply SAP Security Patch Note 3667593 to restore CSRF protection.
  • Verify that the application enforces CSRF tokens and same‑origin policy for state‑changing requests.
  • If the patch cannot be applied immediately, limit user permissions or disable cross‑site request capabilities while monitoring for suspicious activity.

Generated by OpenCVE AI on May 12, 2026 at 04:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Sap Se
Sap Se sap Business Objects Business Intelligence Platform
Vendors & Products Sap Se
Sap Se sap Business Objects Business Intelligence Platform
Type Values Removed Values Added
Description Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send unintended requests to the web server. This has low impact on integrity and availability of the application. There is no impact on confidentiality of the data.
Title Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}
Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

Sources

Status
PUBLISHED
Assigner
sap
Published
Updated
May 12, 2026, 1:04 PM
Reserved
Dec 9, 2025, 10:06 PM

View source JSON

Updated
May 12, 2026, 1:04 PM

JSON

Status
Awaiting Analysis
Published
May 12, 2026, 3:16 AM
Modified
Oct 26, 2026, 6:10 PM

View source JSON

No data.

Updated
May 12, 2026, 5:30 AM

JSON