CVE-2026-34264 MEDIUM

CVE-2026-34264: Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA

Vendor Sap_Se
Product SAP Human Capital Management for SAP S/4HANA
Weakness CWE-204
Published April 14, 2026
Last update April 14, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.

Key dates

02Disclosure timeline

April 14, 2026 CVE published
April 14, 2026 Record updated