EUVD-2026-43594
GHSA-4573-8946-684p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible OData endpoint requires low-privilege authentication; impact is read-only limited disclosure with no integrity or availability effect.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application.
AnalysisAI
Missing authorization in SAP S/4HANA's Create Single Payment function exposes restricted entity set keys to authenticated but low-privileged users. The flaw (CWE-862) allows a restricted user to query specific payment-related entity sets beyond their intended access scope, resulting in low-impact confidentiality leakage with no effect on data integrity or system availability. No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS data was not provided, but the CVSS 4.3 medium score and limited impact scope suggest low exploitation urgency.
Technical ContextAI
CWE-862 (Missing Authorization) indicates the application fails to perform an authorization check before granting access to a resource. In SAP S/4HANA's OData-based Create Single Payment functionality, authorization enforcement is absent for certain entity set key lookups, meaning the application does not verify whether the requesting user's role permits access to those specific data objects. The affected product is identified by CPE cpe:2.3:a:sap_se:sap_s/4_hana_(create_single_payment):*:*:*:*:*:*:*:*, where the wildcard version field implies all currently evaluated versions of the Create Single Payment component are affected. In SAP environments, authorization is typically governed by authorization objects and roles assigned to users; the absence of a check here represents a gap in SAP's PFCG role enforcement for this specific OData service endpoint.
RemediationAI
Apply the fix documented in SAP Security Note 3713902, available via the SAP Support Portal at https://me.sap.com/notes/3713902, released as part of SAP Security Patch Day (https://url.sap/sapsecuritypatchday). An exact patched version or SPS level is not independently confirmed from the available data - customers should verify the specific transport or correction instruction detailed in the note. As a compensating control prior to patching, restrict user role assignments so that only users with a legitimate business need hold access to the Create Single Payment OData service endpoints; audit and tighten existing authorization objects governing payment entity sets. Note that overly broad role restriction may disrupt legitimate payment workflows and should be tested in a non-production environment before deployment.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today