CVE-2026-44771

Missing Authorization check in SAP S/4HANA (Draft operation)

Published Jul 14, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.

Analysis

Technical impact

The vulnerability is a missing authorization check in the SAP S/4HANA Draft operation, identified as CWE-862. An authenticated user that has restricted permissions can access information within the entity, leading to an escalation of privileges. This bypass causes a low impact on confidentiality but does not affect integrity or availability of the application.

Affected Systems

SAP S/4HANA No specific version details are provided in the CNA data.

Risk and Exploitability

The CVSS score of 4.3 classifies the severity as low, and the EPSS score is 0.00172 (<1%). The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation evidence. The likely attack vector requires an authenticated user; it does not enable remote code execution or denial of service. Exploitation would allow the attacker to gain higher privileges within the same entity, but the probability of widespread impact remains low.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SAP_SE

SAP S/4HANA (Draft operation)

unaffected

Version	Status	Constraints
`S4CORE 108`	affected	—

No data.

Vendor Product Versions

Sap Se

Sap S/4hana (draft Operation)

Version	Status	Scheme	Platform
`S4CORE 108`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor-provided security patch or update for SAP S/4HANA Draft operation
Restrict the Draft operation to users who truly need it by enforcing stricter role‑based access control policies
Remove or disable Draft operation for users who do not need it to reduce the attack surface

Generated by OpenCVE AI on July 31, 2026 at 10:53 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.281% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://me.sap.com/notes/3515598
https://url.sap/sapsecuritypatchday

History

Jul 27, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Sap Se Sap Se sap S/4hana (draft Operation)
Vendors & Products		Sap Se Sap Se sap S/4hana (draft Operation)

Jul 16, 2026 4:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 1:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.
Title		Missing Authorization check in SAP S/4HANA (Draft operation)
Weaknesses		CWE-862
References		https://me.sap.com/notes/3515598 https://url.sap/sapsecuritypatchday
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`