Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA (SAP_SE SAP Human Capital Management for SAP S/4HANA)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 19 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Analyzed
Description
During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.
Weaknesses (CWE)
- CWE-204 — Observable Response Discrepancy
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-22174
- GCVE · GCVE-0-2026-34264
CERT-FR advisories
- CERTFR-2026-AVI-0434 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:human_capital_management:s4hcmrxx_100:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:s4hcmrxx_101:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:s4hcmrxx_102:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:sap_hrrxx_600:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:sap_hrrxx_604:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:sap_hrrxx_608:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Human Capital Management for SAP S/4HANA | affected S4HCMRXX 100 ; affected 101 ; affected 102 ; affected SAP_HRRXX 600 ; affected 604 ; affected 608 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |