What’s Vulnerable › Vulnerabilities

CVE-2025-42915: Missing Authorization Check in Fiori app (Manage Payment Blocks)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-09 · updated 2026-06-17
• Weakness: CWE-862

Description

Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities that should be restricted to specific user groups.This issue could impact both the confidentiality and integrity of the application without affecting the availability.

Affected products

• SAP_SE Fiori app (Manage Payment Blocks): S4CORE 107, 108

References

• https://me.sap.com/notes/3409013
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42915 or the next vulnerability affects your stack