EUVD-2026-43588
GHSA-q32w-qvcr-5jr4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated endpoint (AV:N/PR:N), but reliable enumeration requires differential response analysis justifying AC:H; only account existence disclosed (C:L), no integrity or availability impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.
AnalysisAI
User account enumeration in SAP HANA Extended Application Services Classic Model (XSC) user self-service tools allows unauthenticated remote attackers to identify valid usernames and email addresses by crafting requests that elicit distinguishable server responses. The CWE-204 root cause - observable response discrepancy - means the application behaves differently for valid versus invalid accounts, leaking account existence without requiring credentials. CVSS scores this at 3.7 (AV:N/AC:H) reflecting network accessibility tempered by high attack complexity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-204 (Observable Response Discrepancy) describes a class of information disclosure where an application returns measurably different responses - in timing, content, HTTP status codes, or body length - for valid versus invalid inputs. In this case the affected component is the SAP HANA Extended Application Services Classic Model (XSC) user self-service subsystem, identified by CPE cpe:2.3:a:sap_se:sap_hana_extended_application_services_classic_model_(user_self_service):*:*:*:*:*:*:*:*. XSC is the older application-hosting layer within SAP HANA, distinct from the newer XS Advanced (XSA) runtime. The self-service tools typically expose password-reset and account-recovery workflows, which are common vectors for enumeration because they must respond to user input without full authentication - making it structurally difficult to eliminate response divergence without redesigning the workflow.
RemediationAI
The primary remediation is to apply the patch documented in SAP Security Note 3732522 (https://me.sap.com/notes/3732522), released as part of SAP Security Patch Day. An exact fixed version number is not confirmed in the available source data - organizations must consult the SAP note directly via the SAP Support Portal to identify the applicable Support Package or kernel patch level for their HANA version. As a compensating control prior to patching, restrict network access to the XSC user self-service endpoints at the perimeter or WAF layer, allowing only trusted IP ranges to reach the self-service URLs; this reduces exposure without disabling the feature but requires understanding the URL path structure of the deployed XSC application. Rate-limiting requests to self-service endpoints is an additional layer that raises the cost of automated enumeration but does not eliminate the underlying discrepancy.
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today