CVE-2026-27679

Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)

View on CVE.org
Published Apr 14, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.

Analysis

AI-generated

Technical impact

A missing authorization check in the SAP S/4HANA frontend OData Service for managing reference structures allows an attacker to update and delete child entities without proper permissions. This vulnerability primarily compromises the integrity of the system, as unauthorized modifications can alter critical data while leaving confidentiality and availability intact.

Affected Systems

The affected system is SAP S/4HANA Frontend OData Service (Manage Reference Structures) from SAP. Specific versions are not listed in the advisory, so all installations of this service are potentially vulnerable until a patch is applied.

Risk and Exploitability

The CVSS base score is 6.5, indicating a moderate severity and a medium risk to the affected organization. Exploit probability is not quantified in the EPSS data, and the vulnerability is not currently included in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network-based, allowing remote exploitation via exposed OData endpoints.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the SAP security patch that restores authorization checks for the Manage Reference Structures OData service.
  • If patching is delayed, limit outbound or inbound network access to the OData endpoints through firewalls or VPNs to prevent unauthorized users from reaching the service.
  • After applying the patch, verify that unauthorized update and delete operations are blocked by testing with a non‑privileged user account.
  • Regularly monitor SAP security advisories and the SAP support portal for additional patches or configuration recommendations.

Generated by OpenCVE AI on April 14, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Sap manage Reference Structures
Sap s\/4hana
CPEs cpe:2.3:a:sap:manage_reference_structures:uis4h_109:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:-:*:*:*:*:*:*:*
Vendors & Products Sap manage Reference Structures
Sap s\/4hana
Type Values Removed Values Added
First Time appeared Sap
Sap s/4hana
Vendors & Products Sap
Sap s/4hana
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.
Title Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
sap
Published
Updated
Apr 14, 2026, 1:14 PM
Reserved
Feb 23, 2026, 5:50 PM

View source JSON

Updated
Apr 14, 2026, 1:09 PM

JSON

Status
Analyzed
Published
Apr 14, 2026, 12:16 AM
Modified
Oct 26, 2026, 10:10 PM

View source JSON

No data.

Updated
Apr 14, 2026, 4:31 PM

JSON