Medium severity · published Feb 10, 2026
CVE-2026-24312
Missing authorization check in SAP Business Workflow
5.2
CVSS
0.2%
EPSS
No
On KEV
Description
An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high impact on data integrity, with low impact on confidentiality and no impact on availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business Workflow · SAP_SE
SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; +2 more · source: vendor
SB
Sap Basis · Sap
752; 753; 754; 755; 756; 757; +2 more · source: NVD