CVE-2025-26660 Broken Access Control in SAP Fiori apps (Posting Library)
Low-privilege attackers can bypass access controls in SAP Fiori posting library apps to modify data due to inadequate security configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-26660?
CVE-2025-26660 is a medium-severity missing authorization vulnerability in SAP_SE SAP Fiori apps (Posting Library), published on 11 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.
Weakness: CWE-639
Which versions are affected by CVE-2025-26660?
How do I fix CVE-2025-26660?
No fix has been published for CVE-2025-26660 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-26660 being exploited?
There is no known exploitation of CVE-2025-26660 in the wild and no public exploit code.
Sources
Also known as GHSA-6xr2-ww2p-m9pg.