EUVD-2026-55884
GHSA-x65j-6289-5m9j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible admin interface requires authenticated low-privilege user; scope unchanged; impact limited to partial information disclosure with no integrity or availability effect.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.
AnalysisAI
SAP BusinessObjects Business Intelligence Platform (Admin Tools) fails to enforce authorization checks on certain administrative functions, allowing an authenticated low-privilege user to access restricted information. Affected versions include the 2025 release and ENTERPRISE 430. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated session with at least non-administrative (low-privilege) user credentials on the SAP BusinessObjects BI Platform - confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS signals a medium-low risk: network-reachable (AV:N), low complexity (AC:L), low-privilege authenticated access required (PR:L), no user interaction, unchanged scope, and only low confidentiality impact with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch referenced in SAP Security Note 3770649, available via https://me.sap.com/notes/3770649, released as part of SAP Security Patch Day. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today