CVE-2026-89120 — Missing authorization check in SAP ABAP Platform
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, i…
Published: 2026-10-13 · CVSS: 7.1 · CVSS 3.1
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7