What’s Vulnerable › Vulnerabilities

CVE-2025-42917: Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-09 · updated 2026-06-17
• Weakness: CWE-862

Description

SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected.

Affected products

• SAP_SE SAP HCM (Approve Timesheets Fiori 2.0 application): GBX01HR5 605

References

• https://me.sap.com/notes/3643832
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42917 or the next vulnerability affects your stack