SAP HANA CVE-2026-89124

Exploitation requires a valid authenticated account with at least low privileges (PR:L) on the SAP HANA 'Display Product Catalog Based on Customs Declaration' application, and access to the specific functionality where authorization checks are insufficient. Limiting factors: the attacker must already possess credentials (no pre-auth/unauthenticated path), impact is confined to reading data (no write or denial-of-service capability, I:N/A:N), and only confidentiality is partially affected (C:L), so no full data dump of highly sensitive secrets is implied. No victim user interaction is required (UI:N).

This is a low-to-moderate priority issue despite being a network-exploitable flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) shows a network-reachable, low-complexity issue requiring an authenticated low-privileged account, with only limited confidentiality impact and zero integrity or availability impact. This is a classic missing-authorization (CWE-863) information-disclosure bug, not a system-compromise vector. No EPSS score was provided in the input, the CVE is NOT on the CISA KEV list, and no public proof-of-concept was supplied - so there is no public exploit identified at time of analysis. The signals are internally consistent: a modest severity, authenticated access requirement, and single-system scope all point to a genuinely low-urgency finding rather than a high-CVSS-but-low-real-risk mismatch. The main residual risk is an insider or a compromised low-privilege account reading data beyond its authorization scope. Note: the input Tag 'Authentication Bypass' conflicts with the CWE-863 (Improper Authorization) classification and PR:L vector - this is an authorization/access-control flaw, not an authentication bypass, and should not be read as a pre-auth issue.

An authenticated low-privileged user of the SAP HANA 'Display Product Catalog Based on Customs Declaration' application invokes a specific application function and, because authorization is not sufficiently enforced, retrieves catalog/customs data belonging to other users or tenants that is outside their intended scope. No user interaction by a victim and no elevated privileges are required beyond an existing valid low-privilege login (PR:L), but exploitation is limited to reading data (C:L only). No public exploit code is known.