Missing Authorization Check in SAP ERP Central Component and SAP S/4HANA

CVE-2026-0503

What is CVE-2026-0503?

A vulnerability in the SAP ERP Central Component and SAP S/4HANA occurs due to a lack of proper authorization checks. Attackers can exploit this flaw to extract hardcoded clear-text credentials and circumvent password authentication checks by manipulating user parameters. Successful exploitation allows unauthorized access to EHS objects, enabling modifications or deletions of critical change pointer information. This exploitation can have downstream impacts on connected systems, while posing risks to the confidentiality and integrity of the application.

References