{"id":"CVE-2021-21486","aliases":["EUVD-2021-8759","GHSA-6g9h-vg2g-h3mq"],"status":"published","title":"SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616...","description":"SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.","severity":{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0078,"percentile":0.56179,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2021-03-09T14:07:48Z","modified":"2026-06-17T03:35:40Z","products":[{"vendor":"sap","product":"enterprise_financial_services"},{"vendor":"sap se","product":"sap enterprise financial services (bank customer accounts)"}],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/3007888","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21486"},{"url":"https://github.com/advisories/GHSA-6g9h-vg2g-h3mq"}],"sources":{"cve":[{"id":"CVE-2021-21486","description":"SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.","status":"published","published":"2021-03-09T14:07:48Z","modified":"2024-08-03T18:16:23.023Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-8759","description":"SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.","status":"published","published":"2021-03-09T14:07:48Z","modified":"2024-08-03T18:16:23Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T03:25:05.745586Z"}],"ghsa":[{"id":"GHSA-6g9h-vg2g-h3mq","title":"SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616...","description":"SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.","status":"published","published":"2022-05-24T17:44:00Z","modified":"2023-01-29T05:05:58Z","cwes":["CWE-862"],"updated_at":"2026-11-02T14:45:55.193009Z"}],"nvd":[{"id":"CVE-2021-21486","description":"SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.","status":"published","published":"2021-03-09T15:15:14.96Z","modified":"2026-06-17T03:35:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:06:50.399901Z"}]}}