CVE-2026-40132 MEDIUM

CVE-2026-40132: Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)

Vendor Sap_Se
Product SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)
Weakness CWE-862 · Missing authorization
Published May 12, 2026
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This vulnerability also enables the attacker to change the default settings and modify value fields, which will mislead risk evaluations and falsely lower assessed risk levels. This results in a low impact on the confidentiality and integrity of the data. There is no impact on the application�s availability.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 12, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-27151 Discourse doesn't validate destination topic when moving posts CVE-2025-8898 Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover CVE-2025-0935 Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change CVE-2024-56270 WordPress WP SecureSubmit plugin <= 1.5.20 - Sensitive Data Exposure vulnerability CVE-2024-35168 WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability