{"id":"CVE-2024-39596","aliases":["EUVD-2024-38116","GHSA-7fcv-h2v7-g85v"],"status":"published","title":"[CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now","description":"Due to missing authorization checks, SAP Enable\nNow allows an author to escalate privileges to access information which should\notherwise be restricted. On successful exploitation, the attacker can cause\nlimited impact on confidentiality of the application.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00262,"percentile":0.18109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-07-09T04:25:57Z","modified":"2026-06-17T07:42:18Z","products":[{"vendor":"sap_se","product":"sap enable now"}],"references":[{"url":"https://url.sap/sapsecuritypatchday","tags":["x_transferred"]},{"url":"https://me.sap.com/notes/3476348","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39596"},{"url":"https://github.com/advisories/GHSA-7fcv-h2v7-g85v"}],"sources":{"cve":[{"id":"CVE-2024-39596","title":"[CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now","description":"Due to missing authorization checks, SAP Enable\nNow allows an author to escalate privileges to access information which should\notherwise be restricted. On successful exploitation, the attacker can cause\nlimited impact on confidentiality of the application.","status":"published","published":"2024-07-09T04:25:57.251Z","modified":"2024-08-02T04:26:16.017Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-38116","description":"Due to missing authorization checks, SAP Enable\nNow allows an author to escalate privileges to access information which should\notherwise be restricted. On successful exploitation, the attacker can cause\nlimited impact on confidentiality of the application.","status":"published","published":"2024-07-09T04:25:57Z","modified":"2024-08-02T04:26:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-7fcv-h2v7-g85v","title":"Due to missing authorization checks, SAP Enable\nNow allows an author to escalate privileges to...","description":"Due to missing authorization checks, SAP Enable\nNow allows an author to escalate privileges to access information which should\notherwise be restricted. On successful exploitation, the attacker can cause\nlimited impact on confidentiality of the application.","status":"published","published":"2024-07-09T06:30:40Z","modified":"2024-07-09T06:30:50Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:57:39.292896Z"}],"nvd":[{"id":"CVE-2024-39596","description":"Due to missing authorization checks, SAP Enable\nNow allows an author to escalate privileges to access information which should\notherwise be restricted. On successful exploitation, the attacker can cause\nlimited impact on confidentiality of the application.","status":"published","published":"2024-07-09T05:15:12.71Z","modified":"2026-06-17T07:42:18.04Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}