{"id":"CVE-2026-89120","revision":"fdbe8e9f9863446ba7ab8a7815a73e8e","records":[{"revision":"fdbe8e9f9863446ba7ab8a7815a73e8e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89120","aliases":[],"title":"Missing authorization check in SAP ABAP Platform","description":"A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.","state":0,"publishedAt":"2026-10-13T00:27:10.682+00:00","modifiedAt":"2026-10-13T13:28:29.731+00:00","affected":[{"ecosystem":"Vendor product","name":"SAP ABAP Platform","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"SAP_SE\",\n                    \"product\": \"SAP ABAP Platform\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"KERNEL 7.93\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"9.16\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","score":7.1,"severity":"HIGH"}],"references":["https://me.sap.com/notes/3626303","https://url.sap/sapsecuritypatchday"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89120","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89120","identifiers":["CVE-2026-89120"]},"retained":false,"historicalAffected":[]}],"coverage":[]}