CVE-2026-89120CWE-1188

CVE-2026-89120

High · published October 13, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2026-10-13T05:16Z
References (2)
https://me.sap.com/notes/3626303 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 14 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 13 OCT 00:27Z
    Missing authorization check in SAP ABAP Platform
    cvelistv5
  • 13 OCT 00:27Z
    Missing authorization check in SAP ABAP Platform
    cvelistv5