What’s Vulnerable › Vulnerabilities
CVE-2025-26660: Broken Access Control in SAP Fiori apps (Posting Library)
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-11 · updated 2026-06-17
- Weakness: CWE-639
Description
SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.
Affected products
- SAP_SE SAP Fiori apps (Posting Library): S4CORE 103, 104, 105, 106, 107, 108
References
Get alerted when CVE-2025-26660 or the next vulnerability affects your stack