CVE-2026-24321CWE-359

Information Disclosure vulnerability in SAP Commerce Cloud

Medium · published February 10, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2026-02-10T03:03Z
EPSS history
Timeline
  • 10 FEB 03:03Z
    Information Disclosure vulnerability in SAP Commerce Cloud
    cvelistv5