EUVD-2026-55874
GHSA-p684-6ghr-6wm4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible function requires low-privileged authentication; only low confidentiality impact confirmed; no integrity or availability consequence described.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability
AnalysisAI
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows any low-privileged authenticated user to access user account information that is intended to be restricted to privileged roles. The exposed account data - names, identifiers, or contact details of privileged users - can directly enable targeted follow-on attacks such as spear phishing or credential stuffing against identified administrator accounts. No public exploit code or active exploitation has been identified at time of analysis; CVSS 3.1 rates this Medium (4.3) with low confidentiality impact and no integrity or availability impact.
Technical ContextAI
CWE-862 (Missing Authorization) describes the failure to verify that a calling entity holds the required permissions before executing a sensitive function. SAP MII is a specialized platform from SAP SE that integrates shop-floor manufacturing execution data with enterprise resource planning (ERP) systems; it is commonly deployed in discrete and process manufacturing environments. The CPE string cpe:2.3:a:sap_se:sap_manufacturing_integration_and_intelligence:*:*:*:*:*:*:*:* confirms SAP SE as the vendor and encompasses the full SAP MII product line. ENISA EUVD-2026-55874 narrows the affected scope to versions XMII 15.4 and 15.5. The flaw lies in one or more application-layer functions that perform user account lookups or return account information without checking whether the calling user's role grants access to that data - a classic vertical privilege escalation pattern rooted in insufficient server-side authorization logic.
RemediationAI
Apply the patch documented in SAP Note 3781137 (https://me.sap.com/notes/3781137), released as part of SAP Security Patch Day. The note addresses the missing authorization check in SAP MII 15.4 and 15.5; the exact corrected support package or build level must be obtained directly from the SAP Note, as a specific patched version number was not independently confirmed in available intelligence - do not infer a fix version from secondary sources. As an interim compensating control before patching, tighten SAP MII role assignments using SAP role-based access control to restrict access to the affected application functions to only users with a demonstrated business need; this reduces exposure but does not eliminate it if low-privileged accounts legitimately need access to adjacent functions. Audit all existing SAP MII user roles against the principle of least privilege, removing unnecessary low-privileged accounts. Enable and review SAP MII access logs for anomalous patterns of user account enumeration as a detection measure. If SAP MII is internet-exposed, placing it behind a VPN or network segmentation boundary limits the attacker pool to authenticated internal users only.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged applicati
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outs
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible d
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend op
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-priv
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today