EUVD-2026-98194
GHSA-9675-45mq-2fx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitCraft admin API call with target organisation ID
-
ExecutionBypass missing authorization check
-
ImpactExfiltrate other organisation's CLA signature records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with limited privileges on a CLA Assistant instance (PR:L) and use of the admin API endpoint that retrieves CLA signature records when the target organisation is specified by organisation ID - the ID-based code path is where the authorization check is not consistently enforced. The attacker must know or enumerate valid organisation IDs for organisations they do not administer. Limiting factors: a valid authenticated session is required (no unauthenticated access), impact is confined to disclosure of CLA signature/contributor records (no write or availability effect), and the flaw is tied to the organisation-ID lookup variant rather than every access path. |
| Impact | This is a moderate-severity broken-access-control flaw (CWE-862, Missing Authorization) in SAP's CLA Assistant, scored CVSS 6.5. The input vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: network-reachable admin API, low attack complexity, and a low-privileged (PR:L) authenticated account - so this is an authenticated authorization-bypass, not a pre-auth break. Impact is confidentiality-only (C:H, I:N, A:N): disclosure of CLA signature records containing contributor PII, with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis - there is no evidence of active exploitation or widespread weaponization. Weighing the signals together, this is a real but bounded confidentiality/privacy issue rather than an urgent mass-exploitation priority: it requires a valid authenticated account and realistic enumeration of organisation IDs, and the affected product is niche developer tooling. The 'Authentication Bypass' tag is imprecise - the CWE-862 classification and description describe an authorization (access-control) failure for an already-authenticated user, not an authentication bypass; this does not change the score but should be understood when triaging. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged but legitimate account on a CLA Assistant instance calls the admin CLA-signature retrieval endpoint and supplies the numeric organisation ID of an organisation they do not administer. Because the authorization check is not consistently enforced for the ID-based lookup, the endpoint returns CLA signature records - including contributor information - belonging to that other organisation. No public exploit code is identified at time of analysis, so this would require manual crafting of the authenticated API request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Broken access control in SAP CLA Assistant lets any authenticated low-privilege user read the CLA signature records of an organisation they do not administer by supplying that organisation's ID to the admin API endpoint that retrieves signature records; the missing authorization check on the ID-based lookup path exposes contributor names and other signature metadata (CVSS 3.1 score 6.5, CWE-862 Missing Authorization, confidentiality-only impact). Exploitation requires a valid authenticated session with limited privileges and knowledge or enumeration of a valid organisation ID, so it is a targeted information-disclosure issue rather than an unauthenticated compromise. No public exploit identified at time of analysis, and no evidence of active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis, so the primary action is to track SAP's Security Patch Day (https://url.sap/sapsecuritypatchday) and the advisory at https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-8rcv-xqgf-8743 and apply the vendor fix as soon as a version is published. In the interim, the most effective compensating control is to restrict the signature-retrieval admin API endpoint so that it is not reachable by limited-privilege sessions-terminate or proxy the service behind a reverse proxy with explicit path-level ACLs that only permit the endpoint from trusted administrative networks or service accounts, accepting that this will break legitimate automation for organisations whose workflows call the endpoint remotely. Because the missing check is specific to the organisation-ID variant of the lookup, disabling or blocking that variant (for example by rejecting requests that select the organisation by ID and requiring an authorisation-scoped organisation name or slug instead) closes the flaw at the application layer, with the trade-off that clients hard-coded to the ID parameter must be updated and will fail until they are. Additionally, reduce the number of low-privilege authenticated accounts on the CLA Assistant instance, rotate or scope any tokens held by those accounts, and enable request logging on the endpoint so that retrievals referencing organisation IDs outside the caller's administrative scope can be detected and investigated; none of these measures repairs the underlying missing authorization check, so they should be treated as temporary until the SAP fix is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CLA Assistant is a contributor license agreement management service (CPE cpe:2.3:a:sap_se:cla-assistant) that stores and serves CLA signature records for organisations, typically integrated with source-code hosting platforms. The root cause class is CWE-862, Missing Authorization: the endpoint that returns CLA signature records enforces the caller's right to administer the target organisation on some access paths but not consistently on the path where the organisation is selected by organisation ID. Because the authorisation decision is keyed to the request shape rather than the resource owner, a session holding only limited privileges can pass an arbitrary organisation ID and receive that organisation's contributor signature data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms network reachability, low attack complexity, a required authenticated low-privilege account (PR:L, so not unauthenticated), no user interaction, and impact limited to high confidentiality loss with no integrity or availability effect; the CPE version field is a wildcard, meaning the affected version range is not pinned in the available intelligence.
Know when Cla Assistant gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable admin API abused by an authenticated low-privileged user (PR:L), no user interaction; confidentiality-only exposure of contributor PII, so C:H with I:N and A:N.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
DescriptionCVE.org
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB