CVE-2025-26656

4.3 mediumEPSS 0.2%

Medium (4.3). EPSS 0.2% chance of exploitation in the next 30 days.

OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/3474392
https://url.sap/sapsecuritypatchday

Check your stack JSON