Read the docs
TI-2020-05113 Aliases CVE-2020-6258GHSA-5wqx-v74v-cwq8

Missing authorization in SAP Identity Management

Priority LOW 30CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitive information of the victim, leading to Missing Authorization Check.

Why it matters now

EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Fixed SAP Identity Management (SAP SE): 8.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Identity Managementbefore 8.08.0Patch availableCNA
  • SAP Identity Management VendorSAP Affected before 8.0 Fixed in 8.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:identity_management:8.0:*:*:*:*:*:*:*8.0VulnerableSAP
  • cpe:2.3:a:sap:identity_management:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Identity Management (SAP SE) Fixed in 8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6258
  2. 2026-10-03 Alias added: GHSA-5wqx-v74v-cwq8

References

Advisory 1

Other 1

  • TI-2019-00252 Improper privilege management in SAP Identity Management CVSS 3.0HIGH 8.8
  • TI-2018-01802 Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows… CVSS 3.0MEDIUM 5.3
  • TI-2018-01801 SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source. CVSS 3.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences