Authorization Flaw in SAP Strategic Enterprise Management

CVE-2026-40132

What is CVE-2026-40132?

An authorization check flaw exists in SAP Strategic Enterprise Management's Scorecard Wizard within Business Server Pages, allowing an authenticated attacker to gain unauthorized access to sensitive information. This security weakness not only permits viewing restricted data but also enables modifications to default settings and value fields, potentially misleading risk assessments by falsely lowering perceived risk levels. While there is no impact on application availability, the implications for data confidentiality and integrity can be significant. Users are advised to review the security patches and updates released by SAP to mitigate potential risks.

References