{"id":"CVE-2026-34261","aliases":["EUVD-2026-22170","GHSA-fg5q-rjfh-rr88"],"status":"published","title":"Missing Authorization check in SAP Business Analytics and SAP Content Management","description":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00213,"percentile":0.11682,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-04-14T00:08:51Z","modified":"2026-10-26T21:10:00Z","products":[{"vendor":"sap_se","product":"sap business analytics and sap content management"}],"references":[{"url":"https://me.sap.com/notes/3705094"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34261"},{"url":"https://github.com/advisories/GHSA-fg5q-rjfh-rr88"}],"sources":{"cve":[{"id":"CVE-2026-34261","title":"Missing Authorization check in SAP Business Analytics and SAP Content Management","description":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.","status":"published","published":"2026-04-14T00:08:51.232Z","modified":"2026-04-14T13:14:17.473Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-22170","description":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.","status":"published","published":"2026-04-14T00:08:51Z","modified":"2026-04-14T13:14:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:26.535553Z"}],"ghsa":[{"id":"GHSA-fg5q-rjfh-rr88","title":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an...","description":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.","status":"published","published":"2026-04-14T03:31:40Z","modified":"2026-04-14T03:31:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:07:28.42851Z"}],"nvd":[{"id":"CVE-2026-34261","description":"Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.","status":"published","published":"2026-04-14T01:16:03.897Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:14.37744Z"}]}}