Description
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.
Published: 2026-10-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized privilege escalation
Action: Apply patch
AI Analysis

Impact

A regression in the SAP ABAP Platform, caused by an API change, has reintroduced an authorization weakness that was previously fixed. The session manager can be opened in single‑transaction mode, even from the Launchpad (FLP), and a low‑privileged attacker can craft requests to bypass access restrictions. This flaw permits the attacker to modify data or settings, producing a high impact on integrity, while the effect on confidentiality is limited and availability is unaffected.

Affected Systems

The vulnerability affects the SAP ABAP Platform. No specific product versions are listed in the advisory, so any installation of the platform that has not applied the latest maintenance patch is potentially exposed.

Risk and Exploitability

The severity is reflected in a CVSS score of 7.1, indicating a moderate risk. The EPSS score is not available, and the issue is not in the CISA KEV catalog. A low‑privileged user who can send specially crafted requests, possibly over the network or via the SAP Fiori Launchpad, could exploit the missing authorization check. No privileged access or external code execution is required, but the attacker can gain unauthorized control over session‑manager‑related operations, affecting data integrity.

Generated by OpenCVE AI on October 13, 2026 at 03:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the SAP security patch referenced in SAP Note 3626303, which restores the missing authorization check in the session manager.
  • If an immediate patch is not feasible, restrict access to the transaction that opens the session manager in single‑transaction mode.
  • Monitor the system for abnormal requests that could indicate exploitation.

Generated by OpenCVE AI on October 13, 2026 at 03:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap abap Platform
Vendors & Products Sap
Sap abap Platform

Tue, 13 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.
Title Missing authorization check in SAP ABAP Platform
Weaknesses CWE-1188
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'}

Subscriptions

Sap Abap Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-10-13T13:28:29.731Z

Reserved: 2026-09-10T22:25:18.639Z

Link: CVE-2026-89120

cve-icon Vulnrichment

Updated: 2026-10-13T13:19:47.883Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T01:16:48.813

Modified: 2026-10-15T20:38:04.303

Link: CVE-2026-89120

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:15:15Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default