CVE-2026-24326 MEDIUM

CVE-2026-24326: Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations)

Vendor Sap_Se
Product SAP S/4HANA Defense & Security (Disconnected Operations)
Weakness CWE-862 · Missing authorization
Published February 10, 2026
Last update February 10, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.

Key dates

02Disclosure timeline

February 10, 2026 CVE published
February 10, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-48246 WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability CVE-2025-67584 WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability CVE-2024-0702 Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization CVE-2025-58247 WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability CVE-2025-50009 WordPress Kata Plus plugin <= 1.5.3 - Broken Access Control Vulnerability