Authorization Flaw in SAP S/4HANA Due to Insufficient Checks

CVE-2026-66764

What is CVE-2026-66764?

The Reprocess Bank Statement Items feature in SAP S/4HANA lacks the necessary authorization checks for authenticated users. This flaw enables users to access and utilize rules that have not been explicitly shared with them, potentially leading to privilege escalation. Although the vulnerability poses a limited threat to confidentiality, it does not compromise the integrity or availability of the application, highlighting the need for prompt remediation.

References