CVE-2026-89121— Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
Quick assessment
Affected
SAP_SE SAP S/4HANA (Linear Asset Management RAP Business Object)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP S/4HANA 在对其相关业务对象数据的某些修改操作时，未执行充分的实例级授权检查。拥有低权限且具备本地系统访问权限的攻击者可以绕过授权检查，从而修改其无权访问的业务对象数据。此漏洞会对数据完整性造成高影响，但对机密性和可用性无影响。
Possible ATT&CK Techniques 2 AI
T1546.008 · Accessibility Features T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP S/4HANA (Linear Asset Management RAP Business Object) | S4CORE 109 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89121
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
Source: CVE Program / CVE List V5
Vulnerability Description
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP S/4HANA (Linear Asset Management RAP Business Object) | S4CORE 109 | - |
|
II. Public POCs for CVE-2026-89121
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89121
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2026-10-13 · 20 CVEs total
| CVE-2026-89111 | 10.0 CRITICAL | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python |
| CVE-2026-89107 | 9.9 CRITICAL | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) |
| CVE-2026-89110 | 9.9 CRITICAL | Broken Access Control in SAP NetWeaver Visual Composer |
| CVE-2026-89108 | 9.1 CRITICAL | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configurati |
| CVE-2026-89113 | 8.8 HIGH | SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) |
| CVE-2026-58249 | 7.5 HIGH | Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communic |
| CVE-2026-89120 | 7.1 HIGH | Missing authorization check in SAP ABAP Platform |
| CVE-2026-89112 | 6.5 MEDIUM | Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure |
| CVE-2026-76972 | 6.5 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence |
| CVE-2026-89122 | 6.1 MEDIUM | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89117 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-76975 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) |
| CVE-2026-89116 | 5.9 MEDIUM | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code |
| CVE-2026-76976 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applica |
| CVE-2026-89118 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89106 | 4.4 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAPUI5 |
| CVE-2026-89124 | 4.3 MEDIUM | Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Pr |
| CVE-2026-89105 | 4.2 MEDIUM | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integra |
| CVE-2026-58242 | 3.5 LOW | Improper Authorization check in SAP Cloud Connector |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-89124
Missing Authorization Check in SAP Global Trade Services, ed -
CVE-2026-89122
Open Redirect Vulnerability in SAP NetWeaver Enterprise Port -
CVE-2026-89120
Missing authorization check in SAP ABAP Platform -
CVE-2026-89118
Information Disclosure vulnerability in SAP NetWeaver Enterp -
CVE-2026-89117
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En
Same weakness: CWE-862
-
CVE-2026-17092
Directorist: AI-Powered Business Directory, Listings & Class -
CVE-2026-103423
Booking Package <= 1.7.29 - Missing Authorization to Unauthe -
CVE-2026-110160
Chrome <155.0.8059.79 缺少授权漏洞 -
CVE-2026-63172
Omnispace Agora Project < 26.10.0 Broken Function-Level Auth -
CVE-2026-63174
Omnispace Agora Project < 26.10.0 Broken Access Control via
V. Comments for CVE-2026-89121
No comments yet