Insufficient Authorization Checks in SAP S/4HANA

CVE-2026-89121

What is CVE-2026-89121?

In SAP S/4HANA, insufficient instance-level authorization checks are present for certain modification operations on related business object data. This vulnerability allows an attacker with low privileges and local access to bypass the necessary authorization controls, enabling them to alter data pertaining to objects for which they lack proper permissions. The issue poses a significant risk to data integrity within the system, although it does not affect confidentiality or availability. For more details, refer to SAP's official security notes.

References