CVE-2025-42939 MEDIUM

CVE-2025-42939: Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements)

Vendor Sap_Se
Product SAP S/4HANA (Manage Processing Rules - For Bank Statements)
Weakness CWE-863 · Incorrect authorization
Published October 14, 2025
Last update October 14, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability.

Key dates

02Disclosure timeline

October 14, 2025 CVE published
October 14, 2025 Record updated