CVE-2026-24312 MEDIUM

CVE-2026-24312: Missing authorization check in SAP Business Workflow

Vendor Sap_Se
Product SAP Business Workflow
Weakness CWE-862 · Missing authorization
Published February 10, 2026
Last update February 10, 2026

CVSS base score

5.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N

What the vulnerability does

01Description

An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high impact on data integrity, with low impact on confidentiality and no impact on availability of the application.

Key dates

02Disclosure timeline

February 10, 2026 CVE published
February 10, 2026 Record updated

Related vulnerabilities

04Related CVE