SAP BusinessObjects Business Intelligence Platform CVE-2026-0502

The vulnerability requires an authenticated user to be logged into SAP BusinessObjects Business Intelligence Platform at the time the attacker's malicious page is visited. The attacker must trick the user into visiting a malicious website or clicking a crafted link through social engineering; there is no mechanism for the attacker to independently trigger the request without user interaction. The attack is limited to state-changing operations (POST/PUT/DELETE requests) that the BI Platform user has permission to perform - attackers cannot read data or execute arbitrary code, only modify application state within the victim's authorization scope. Default browser cookie policies and modern anti-CSRF protections (SameSite attributes, CSP) provide partial mitigation if enabled, but the underlying vulnerability exists due to insufficient CSRF token validation in the application itself.

The CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L reflects a network-exploitable vulnerability with low attack complexity but requiring user interaction and no special privileges. The absence of confidentiality impact is significant - attackers cannot extract sensitive data directly. However, the integrity and availability impacts (both Low) indicate the attack can modify data or degrade service through authenticated user sessions. The UI:R requirement (user must click a link or visit a malicious site) is a critical limiting factor reducing real-world risk compared to fully automated attacks. The unscoped impact (S:U) means privilege escalation is not a factor. EPSS score and active exploitation status are not provided; without KEV confirmation or POC evidence, this should be considered a standard CSRF vulnerability with moderate risk primarily to operations requiring user tricking rather than widespread automated exploitation. Organizations with user-awareness training and browser security features (SameSite by default, CSP) have meaningful mitigations in place.

An attacker crafts a malicious webpage containing JavaScript or a hidden form that submits a request to the BusinessObjects BI Platform (e.g., modifying a report, changing user permissions, or disabling a data source). The attacker sends the URL of this malicious page to an authenticated BI Platform user via email or social engineering. When the user visits the attacker's page while logged into BusinessObjects BI Platform in another browser tab, the browser automatically includes the session cookie with the request, causing the unintended action to execute on the victim's behalf. If the victim is an administrator, the attacker could escalate their own privileges or alter critical reports.