SAP S/4HANA CVE-2026-89121

Requires an attacker who is already a low-privilege authenticated user with local/interactive access to the SAP S/4HANA system (PR:L, AV:L) and who targets modification operations on associated business objects within the Linear Asset Management RAP business object. Exploitation is further limited by high attack complexity (AC:H), indicating that specific runtime or data-association conditions outside the attacker's control must be satisfied for the instance-level authorization check to be bypassed. No remote or unauthenticated path exists, and no user interaction by a victim is needed (UI:N). This is not exploitable against an attacker with no system account.

This is a genuinely low-to-moderate priority issue despite the 'Authentication Bypass' tag suggesting something more severe. The CVSS 3.1 base score of 4.7 (Medium) is driven down by three limiting metrics in the vendor-supplied vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N: local attack vector (AV:L) means the attacker must already have interactive/logged-on access to the SAP system, high attack complexity (AC:H) implies conditions outside the attacker's control, and low-privilege authentication (PR:L) is required - so this is not a remote, unauthenticated, point-and-click flaw. The only real impact is on integrity (I:H), with no confidentiality (C:N) or availability (A:N) exposure; the damage is limited to tampering with business-object data the attacker is not authorized for. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC referenced, so this is no public exploit identified at time of analysis. CWE-862 (Missing Authorization) is consistent with the description of insufficient instance-level authorization checks. Net assessment: a real but constrained privilege/authorization defect requiring an existing low-privilege foothold and high complexity - patch in normal cycle rather than emergency, but prioritize in environments where many users hold low-privilege S/4HANA accounts.

A low-privilege user who already has local, authenticated access to the SAP S/4HANA system invokes a modification operation on an associated business object within the Linear Asset Management RAP business object. Because instance-level authorization is not sufficiently enforced, the request succeeds against asset data the user is not entitled to change, corrupting integrity of records they should not be able to touch. No public exploit code is referenced, and the high attack complexity (AC:H) means specific conditions must be met for the bypass to trigger.