CVE-2026-27686 MEDIUM

CVE-2026-27686: Missing Authorization check in SAP Business Warehouse (Service API)

Vendor Sap_Se
Product SAP Business Warehouse (Service API)
Weakness CWE-862 · Missing authorization
Published March 10, 2026
Last update March 10, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.

Key dates

02Disclosure timeline

March 10, 2026 CVE published
March 10, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-62865 WordPress Post Cloner plugin <= 1.0.0 - Broken Access Control vulnerability CVE-2024-0983 ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization CVE-2023-46635 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerability CVE-2024-23503 WordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerability CVE-2025-49991 WordPress WP-Recall plugin <= 16.26.14 - Broken Access Control Vulnerability