Log in Start free

Vulnerability · Published Feb 10, 2026 · Assigned by sap

CVE-2026-24312Missing authorization check in SAP Business Workflow

Medium 5.2

In plain English

A medium-severity missing authorization in SAP Business Workflow from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.2Medium
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high impact on data integrity, with low impact on confidentiality and no impact on availability of the application.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP Business Workflow SAP_BASIS 752SAP_BASIS 753SAP_BASIS 754SAP_BASIS 755SAP_BASIS 756SAP_BASIS 757SAP_BASIS 758SAP_BASIS 816

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N

References