CVE-2026-24327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24327", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-21T22:15:36.673Z", "datePublished": "2026-02-10T03:04:46.790Z", "dateUpdated": "2026-02-10T16:12:07.367Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SEM-BW 600"}, {"status": "affected", "version": "602"}, {"status": "affected", "version": "603"}, {"status": "affected", "version": "604"}, {"status": "affected", "version": "605"}, {"status": "affected", "version": "634"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "736"}, {"status": "affected", "version": "746"}, {"status": "affected", "version": "747"}, {"status": "affected", "version": "748"}, {"status": "affected", "version": "800"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability.</p>"}], "value": "Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:04:46.790Z"}, "references": [{"url": "https://me.sap.com/notes/3680390"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T16:11:57.439319Z", "id": "CVE-2026-24327", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:12:07.367Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24327", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T16:11:57.439319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:12:04.040Z"}}], "cna": {"title": "Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)", "versions": [{"status": "affected", "version": "SEM-BW 600"}, {"status": "affected", "version": "602"}, {"status": "affected", "version": "603"}, {"status": "affected", "version": "604"}, {"status": "affected", "version": "605"}, {"status": "affected", "version": "634"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "736"}, {"status": "affected", "version": "746"}, {"status": "affected", "version": "747"}, {"status": "affected", "version": "748"}, {"status": "affected", "version": "800"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3680390"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:04:46.790Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24327", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:12:07.367Z", "dateReserved": "2026-01-21T22:15:36.673Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:04:46.790Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "SEM-BW 600"}, {"status": "affected", "version": "602"}, {"status": "affected", "version": "603"}, {"status": "affected", "version": "604"}, {"status": "affected", "version": "605"}, {"status": "affected", "version": "634"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "736"}, {"status": "affected", "version": "746"}, {"status": "affected", "version": "747"}, {"status": "affected", "version": "748"}, {"status": "affected", "version": "800"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:600:*:*:*:*:*:*:*", "matchCriteriaId": "2FDD6A72-3274-4DA0-8FCC-2DCBEAEF3796", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:602:*:*:*:*:*:*:*", "matchCriteriaId": "8F37F0CE-282C-4558-A28B-AEDF3026EC37", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:603:*:*:*:*:*:*:*", "matchCriteriaId": "67617A83-F329-4520-95A8-07A1AF6A3BE5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:604:*:*:*:*:*:*:*", "matchCriteriaId": "FE85E4AC-1C91-4B50-8C30-0B23E3D809B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:605:*:*:*:*:*:*:*", "matchCriteriaId": "9CD2A924-479C-46D8-9E9E-894C5B312485", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:634:*:*:*:*:*:*:*", "matchCriteriaId": "19F513E0-E7C5-4DDC-BC32-BE26E64789C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:700:*:*:*:*:*:*:*", "matchCriteriaId": "24CB2786-0E05-4E4A-9951-CBAC3B4F2B9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:736:*:*:*:*:*:*:*", "matchCriteriaId": "65BFD1E4-B940-400B-9776-A56B96F234C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:746:*:*:*:*:*:*:*", "matchCriteriaId": "A63A80AE-2988-4335-8E72-71B66B412CF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:747:*:*:*:*:*:*:*", "matchCriteriaId": "B3FF97BE-502F-4DA9-97BC-FA504DCA2FEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:748:*:*:*:*:*:*:*", "matchCriteriaId": "82DB344B-AFC6-4211-86EB-AE5E5D96E213", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:strategic_enterprise_management:800:*:*:*:*:*:*:*", "matchCriteriaId": "C06928C2-E38C-48D6-9FD5-712B003A7B17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability."}, {"lang": "es", "value": "Debido a la falta de verificaci\u00f3n de autorizaci\u00f3n en SAP Strategic Enterprise Management (Balanced Scorecard en Business Server Pages), un atacante autenticado podr\u00eda acceder a informaci\u00f3n a la que de otro modo no est\u00e1 autorizado a ver. Esto conlleva a un bajo impacto en la confidencialidad y ning\u00fan efecto en la integridad o disponibilidad."}], "id": "CVE-2026-24327", "lastModified": "2026-06-17T10:22:54.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24327", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T16:11:57.439319Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:05.113", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3680390"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SEM-BW 600"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "602"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "603"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "604"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "605"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "634"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "700"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "736"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "746"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "747"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "748"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "800"}}], "product": "sap_strategic_enterprise_management_(balanced_scorecard_in_bsp_application)", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-17T20:54:48.049967+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch referenced in SAP note 3680390 or through the SAP Security Patch Day release", "After patching, review user role assignments to ensure least\u2011privilege access for the Balanced Scorecard component", "Monitor application logs for anomalies such as repeated access to restricted data outside normal user patterns"], "summary": {"action": "Apply Patch", "impact": "Unauthorized data disclosure"}, "threat_synthesis": {"affected_systems": "This flaw affects SAP Strategic Enterprise Management as identified by SAP SE, covering versions 600, 602, 603, 604, 605, 634, 700, 736, 746, 747, 748, and 800. The issue resides in the Balanced Scorecard web application delivered via Business Server Pages.", "description_and_impact": "The vulnerability is a missing authorization check in the Balanced Scorecard component of SAP Strategic Enterprise Management\u2019s Business Server Pages. An authenticated user can view data that they should not have access to, creating a modest breach of confidentiality while leaving integrity and availability unaffected.", "risk_and_exploitability": "With a CVSS score of 4.3 the overall severity is considered low. The EPSS score of less than 1% reflects a very low likelihood of actual exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector involves a legitimate user account with access to the application; the attacker can exploit the missing check by using their standard credentials to request privileged data via the web interface."}}}}, "created": "2026-02-10T11:34:35.992887+00:00", "updated": "2026-04-17T21:00:12.716231+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_strategic_enterprise_management_(balanced_scorecard_in_bsp_application)"]}