CVE-2026-23688

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23688", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-14T18:26:17.297Z", "datePublished": "2026-02-10T03:02:58.702Z", "dateUpdated": "2026-02-10T17:18:34.212Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Fiori App (Manage Service Entry Sheets - Lean Services)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted.</p>"}], "value": "SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:02:58.702Z"}, "references": [{"url": "https://me.sap.com/notes/3215823"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T17:18:26.924360Z", "id": "CVE-2026-23688", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T17:18:34.212Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23688", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T17:18:26.924360Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T17:18:30.673Z"}}], "cna": {"title": "Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Fiori App (Manage Service Entry Sheets - Lean Services)", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3215823"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:02:58.702Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23688", "state": "PUBLISHED", "dateUpdated": "2026-02-10T17:18:34.212Z", "dateReserved": "2026-01-14T18:26:17.297Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:02:58.702Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Fiori App (Manage Service Entry Sheets - Lean Services)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*", "matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*", "matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*", "matchCriteriaId": "964023CE-6EA4-42BB-93B2-DCE6B36D3F89", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*", "matchCriteriaId": "84B775EF-6C11-4FAB-B5E7-8F6C4C5674BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*", "matchCriteriaId": "14D17245-5B6D-4024-AFA6-8E0A70B294BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*", "matchCriteriaId": "5DEFABE8-1797-4C7B-941C-3205AE90914B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted."}, {"lang": "es", "value": "La aplicaci\u00f3n SAP Fiori Gestionar Hojas de Entrada de Servicios no realiza las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, resultando en una escalada de privilegios. Esto tiene bajo impacto en la integridad, la confidencialidad y la disponibilidad no se ven afectadas."}], "id": "CVE-2026-23688", "lastModified": "2026-06-17T10:21:57.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23688", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T17:18:26.924360Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:03.340", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3215823"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "S4CORE 102"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "103"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "104"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "105"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "106"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "107"}}], "product": "sap_fiori_app_(manage_service_entry_sheets_-_lean_services)", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-17T20:58:04.209355+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch referenced in SAP Note 3215823 and any successor patch releases.", "Restart the SAP Fiori services to ensure the patch configuration is reloaded.", "Review all user roles and remove any unnecessary authorities so that only authorized personnel can access privileged functions."], "summary": {"action": "Patch Promptly", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Vendors affected include SAP, specifically the SAP Fiori App (Manage Service Entry Sheets \u2013 Lean Services). The vulnerability applies to SAP S/4HANA core releases 102 through 107 as listed in the CPE data.", "description_and_impact": "The SAP Fiori App for Manage Service Entry Sheets lacks sufficient authorization checks for authenticated users, allowing them to perform privileged operations. This flaw permits a non-privileged user to elevate privileges within the application. The impact on data integrity is low, and there is no effect on confidentiality or availability.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The flaw is not currently listed in CISA's KEV catalog. Exploitation requires the attacker to be authenticated to the Fiori application; once logged in, the absence of proper authorization enables the user to execute privileged actions that should be restricted."}}}}, "created": "2026-02-10T11:34:40.365759+00:00", "updated": "2026-04-17T21:00:12.728124+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_fiori_app_(manage_service_entry_sheets_-_lean_services)"]}