What’s Vulnerable › Vulnerabilities
CVE-2025-42913: Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)
- Severity: low (CVSS 3.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-09 · updated 2026-06-17
- Weakness: CWE-862
Description
Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.
Affected products
- SAP_SE SAP HCM (My Timesheet Fiori 2.0 application): GBX01HR5 605
References
Get alerted when CVE-2025-42913 or the next vulnerability affects your stack