Authorization Bypass in SAP ABAP Platform

CVE-2026-89120

What is CVE-2026-89120?

A regression caused by an API change in the SAP ABAP Platform has reintroduced an authorization weakness that had been previously addressed. This vulnerability allows a low-privileged attacker to exploit the session manager in single transaction mode, which can be accessed from the Fiori Launchpad (FLP). By sending specially crafted requests, an attacker may successfully bypass existing security restrictions. The potential impact includes significant risks to data integrity, while confidentiality remains minimally affected. Availability of the system is not compromised.

References