Missing authorization in SAP ERP Sales
Priority LOW 29CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges.
Why it matters now
EPSS 0.00737 54th percentileScored 2026-11-07
Fix Fixed SAP ERP Sales (SAP_APPL) (SAP SE): 6.0, 6.02, 6.03 +6S4HANA Sales (S4CORE) (SAP SE): 1.0, 1.01, 1.02 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP ERP Sales (SAP_APPL) | before 6.0; before 6.02; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.17; before 6.18 | 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 | Patch available | CNA |
| SAP | S4HANA Sales (S4CORE) | before 1.0; before 1.01; before 1.02; before 1.03; before 1.04 | 1.0, 1.01, 1.02, 1.03, 1.04 | Patch available | CNA |
- SAP ERP Sales (SAP_APPL) VendorSAP Affected before 6.0; before 6.02; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.17; before 6.18 Fixed in 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 Patch available CNA
- S4HANA Sales (S4CORE) VendorSAP Affected before 1.0; before 1.01; before 1.02; before 1.03; before 1.04 Fixed in 1.0, 1.01, 1.02, 1.03, 1.04 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:erp_sales:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.02:*:*:*:*:*:*:* | 6.02 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.03:*:*:*:*:*:*:* | 6.03 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.04:*:*:*:*:*:*:* | 6.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.05:*:*:*:*:*:*:* | 6.05 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.06:*:*:*:*:*:*:* | 6.06 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.16:*:*:*:*:*:*:* | 6.16 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.17:*:*:*:*:*:*:* | 6.17 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_sales:6.18:*:*:*:*:*:*:* | 6.18 | Vulnerable | SAP |
| cpe:2.3:a:sap:s4hana_sales:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | SAP |
- cpe:2.3:a:sap:erp_sales:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.02:*:*:*:*:*:*:* Versions 6.02 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.03:*:*:*:*:*:*:* Versions 6.03 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.04:*:*:*:*:*:*:* Versions 6.04 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.05:*:*:*:*:*:*:* Versions 6.05 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.16:*:*:*:*:*:*:* Versions 6.16 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.17:*:*:*:*:*:*:* Versions 6.17 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_sales:6.18:*:*:*:*:*:*:* Versions 6.18 Vulnerable ·SAP
- cpe:2.3:a:sap:s4hana_sales:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·SAP
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:s4hana_sales:1.01:*:*:*:*:*:*:* | 1.01 | Vulnerable | SAP |
| cpe:2.3:a:sap:s4hana_sales:1.02:*:*:*:*:*:*:* | 1.02 | Vulnerable | SAP |
| cpe:2.3:a:sap:s4hana_sales:1.03:*:*:*:*:*:*:* | 1.03 | Vulnerable | SAP |
| cpe:2.3:a:sap:s4hana_sales:1.04:*:*:*:*:*:*:* | 1.04 | Vulnerable | SAP |
- cpe:2.3:a:sap:s4hana_sales:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·SAP
- cpe:2.3:a:sap:s4hana_sales:1.02:*:*:*:*:*:*:* Versions 1.02 Vulnerable ·SAP
- cpe:2.3:a:sap:s4hana_sales:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·SAP
- cpe:2.3:a:sap:s4hana_sales:1.04:*:*:*:*:*:*:* Versions 1.04 Vulnerable ·SAP
Remediation
- Fix · CNA SAP ERP Sales (SAP_APPL) (SAP SE) Fixed in 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18
- Fix · CNA S4HANA Sales (S4CORE) (SAP SE) Fixed in 1.0, 1.01, 1.02, 1.03, 1.04
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0386
- 2026-10-03 Alias added: GHSA-wcf6-rgr3-qr83
References
Sources
- CVE-2019-0386 · CVE Program
- CVE-2019-0386 · NVD
- FIRST EPSS
- GHSA-wcf6-rgr3-qr83 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences