Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)

Summary

CVE	CVE-2026-34256
State	PUBLISHED
Assigner	sap
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-04-14 01:16:03 UTC
Updated	2026-04-17 15:18:16 UTC
Description	Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

Risk And Classification

Primary CVSS: v3.1 7.1 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS: 0.000410000 probability, percentile 0.123970000 (date 2026-04-21)

Problem Types: CWE-862 | CWE-862 CWE-862: Missing Authorization

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	7.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H`
3.1	CNA	CVSS	7.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected SAP_FIN 618	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 720	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 730	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected EA-FIN 617	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 700	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected SAPSCORE 135	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected S4CORE 102	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 103	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 104	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 105	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 106	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 107	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 108	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 109	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected EA-APPL 600	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 602	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 603	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 604	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 605	Not specified
CNA	SAP SE	SAP ERP And SAP S/4 HANA Private Cloud And On-Premise	affected 606	Not specified

References

Reference	Source	Link	Tags
url.sap/sapsecuritypatchday	[email protected]	url.sap
me.sap.com/notes/3731908	[email protected]	me.sap.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.