What is the CVSS score of EUVD-2026-55884?

EUVD-2026-55884 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

SAP BusinessObjects EUVD-2026-55884

| CVE-2026-66772 MEDIUM

Missing Authorization (CWE-862)

2026-08-11 sap

GHSA-x65j-6289-5m9j

Authentication Bypass SAP Sap Businessobjects Business Intelligence Platform Admin Tools Sap Se

4.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible admin interface requires authenticated low-privilege user; scope unchanged; impact limited to partial information disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:11 vuln.today

DescriptionCVE.org

SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.

AnalysisAI

SAP BusinessObjects Business Intelligence Platform (Admin Tools) fails to enforce authorization checks on certain administrative functions, allowing an authenticated low-privilege user to access restricted information. Affected versions include the 2025 release and ENTERPRISE 430. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 4.3 rating with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

SAP BusinessObjects BI Platform is an enterprise reporting and analytics suite. The Admin Tools component exposes administrative functionality that is gated by role-based access controls. CWE-862 (Missing Authorization) indicates that the application fails to verify whether the authenticated caller holds the required administrative role before serving a privileged response - a server-side access control enforcement failure, not a client-side bypass. The CPE cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform_(admin_tools):*:*:*:*:*:*:*:* covers the affected product family across both the 2025 and ENTERPRISE 430 release lines.

RemediationAI

Apply the patch referenced in SAP Security Note 3770649, available via https://me.sap.com/notes/3770649, released as part of SAP Security Patch Day. An exact fixed build version was not confirmed in the available intelligence data - consult the SAP note directly for the specific support package or patch level. As a compensating control while patching is scheduled, restrict platform access to the Admin Tools component by tightening network perimeter rules to limit which authenticated users can reach the administrative interface, and audit non-administrative accounts for any role escalation. No adverse side effects of the vendor patch are documented in available references.