What is the CVSS score of EUVD-2026-55881?

EUVD-2026-55881 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

SAP S/4HANA EUVD-2026-55881

| CVE-2026-66764 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-11 sap

GHSA-f866-c6jw-4pqx

Authentication Bypass Privilege Escalation SAP Sap S 4 Hana Reprocess Bank Statement Items Sap Se

4.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Authenticated network access required (PR:L, AV:N); impact strictly limited to low confidentiality exposure with no integrity or availability effect per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:10 vuln.today

CVE Published

Aug 11, 2026 - 00:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application

AnalysisAI

Privilege escalation in SAP S/4HANA's Reprocess Bank Statement Items component allows authenticated users to invoke processing rules that have not been explicitly shared with them, circumventing intended access controls. Affected versions span S4CORE releases 104 through 109, covering a broad swath of actively supported SAP S/4HANA deployments. The impact is confined to low-severity information disclosure - unauthorized rule access reveals restricted bank statement logic - with no integrity or availability consequences; no public exploit or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaw where an application retrieves an object using a key supplied or controlled by the user without verifying that the requesting user holds authorization to access that specific object. In SAP S/4HANA's Reprocess Bank Statement Items feature, processing rules are a shareable artifact: administrators create rules and selectively share them with designated users. The application fails to enforce this sharing constraint server-side, trusting the rule identifier supplied in the request rather than validating entitlement. The CPE string cpe:2.3:a:sap_se:sap_s/4_hana_(reprocess_bank_statement_items):*:*:*:*:*:*:*:* confirms the affected component is scoped to this specific functional module rather than the SAP S/4HANA platform as a whole.

RemediationAI

The primary remediation is to apply the fix delivered in SAP Security Note 3669608, accessible through the SAP Support Portal at https://me.sap.com/notes/3669608. SAP distributes patches for this class of vulnerability via standard Support Package or correction transport; customers should identify the appropriate transport for their S4CORE release (104-109) and apply it through their standard change management process. Until the patch is applied, a compensating control is to audit and restrict which user accounts have access to the Reprocess Bank Statement Items transaction, minimizing the set of accounts that could abuse the missing authorization check. Additionally, reviewing existing rule-sharing configurations to ensure sensitive rules are not accessible to broad user groups will limit exposure. SAP Security Patch Day guidance is published at https://url.sap/sapsecuritypatchday and should be consulted for patch release timing specific to each support package level.