Unauthorized Access Vulnerability in SAP S/4HANA OData Service

CVE-2026-27678

What is CVE-2026-27678?

A vulnerability exists in the SAP S/4HANA backend OData Service (Manage Reference Structures), where insufficient authorization checks allow attackers to update and delete child entities via exposed OData services. This flaw poses a significant risk to data integrity, enabling unauthorized modifications that could lead to compromised data management. The issue does not affect confidentiality or availability, but organizations using SAP S/4HANA should take immediate steps to mitigate this risk.

References