CVE-2026-34261

{
  "id": "CVE-2026-34261",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-14T01:16:03.897",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability."
    },
    {
      "lang": "es",
      "value": "Debido a una comprobación de autorización faltante en SAP Business Analytics y SAP Content Management, un usuario autenticado podría realizar llamadas no autorizadas a ciertos módulos de función remotos, potencialmente accediendo a información sensible más allá de sus permisos previstos. Esta vulnerabilidad afecta la confidencialidad, sin impacto en la integridad y disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Business Analytics and SAP Content Management",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "S4HCMRXX 100",
              "status": "affected"
            },
            {
              "version": "101",
              "status": "affected"
            },
            {
              "version": "102",
              "status": "affected"
            },
            {
              "version": "SAP_HRRXX 600",
              "status": "affected"
            },
            {
              "version": "604",
              "status": "affected"
            },
            {
              "version": "608",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T12:53:23.140179Z",
          "id": "CVE-2026-34261",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3705094",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}