CVE-2026-89124— Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)
Quick assessment
Affected
SAP_SE SAP HANA (Display Product Catalog Based on Customs Declaration)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在“显示产品目录”模块中，基于报关申请的功能未能执行充分的授权检查，导致经身份验证的低权限用户能够访问超出其授权范围的敏感信息。该漏洞对数据的机密性影响较低，对应用程序的完整性和可用性无影响。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP HANA (Display Product Catalog Based on Customs Declaration) | GTSCORE 200 |
affected |
300 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89124
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)
Source: CVE Program / CVE List V5
Vulnerability Description
Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on confidentiality of the data, with no impact on the integrity and availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP HANA (Display Product Catalog Based on Customs Declaration) | GTSCORE 200 | - |
|
II. Public POCs for CVE-2026-89124
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89124
请登录查看更多情报信息。
Other References for CVE-2026-89124 (1)
Same Patch Batch · SAP_SE · 2026-10-13 · 20 CVEs total
| CVE-2026-89111 | 10.0 CRITICAL | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python |
| CVE-2026-89107 | 9.9 CRITICAL | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) |
| CVE-2026-89110 | 9.9 CRITICAL | Broken Access Control in SAP NetWeaver Visual Composer |
| CVE-2026-89108 | 9.1 CRITICAL | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configurati |
| CVE-2026-89113 | 8.8 HIGH | SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) |
| CVE-2026-58249 | 7.5 HIGH | Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communic |
| CVE-2026-89120 | 7.1 HIGH | Missing authorization check in SAP ABAP Platform |
| CVE-2026-89112 | 6.5 MEDIUM | Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure |
| CVE-2026-76972 | 6.5 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence |
| CVE-2026-89122 | 6.1 MEDIUM | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89117 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-76975 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) |
| CVE-2026-89116 | 5.9 MEDIUM | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code |
| CVE-2026-76976 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applica |
| CVE-2026-89118 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89121 | 4.7 MEDIUM | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) |
| CVE-2026-89106 | 4.4 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAPUI5 |
| CVE-2026-89105 | 4.2 MEDIUM | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integra |
| CVE-2026-58242 | 3.5 LOW | Improper Authorization check in SAP Cloud Connector |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-89122
Open Redirect Vulnerability in SAP NetWeaver Enterprise Port -
CVE-2026-89121
Missing Authorization Check in SAP S/4HANA (Linear Asset Man -
CVE-2026-89120
Missing authorization check in SAP ABAP Platform -
CVE-2026-89118
Information Disclosure vulnerability in SAP NetWeaver Enterp -
CVE-2026-89117
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En
Same weakness: CWE-863
-
CVE-2026-110904
CVE-2026-110904 -
CVE-2026-110873
Heym 0.0.55 before 0.0.121 Credential Theft via error_workfl -
CVE-2026-110867
Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shar -
CVE-2026-110850
n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Age -
CVE-2026-110844
n8n before 1.123.83 Credential Authorization Bypass via Nest
V. Comments for CVE-2026-89124
No comments yet