Missing authorization in SAP ERP HCM
Priority LOW 30CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.
Why it matters now
EPSS 0.00834 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP ERP HCM (Portugal) | 600; 604; 608 | — | No fix listed | CNA |
- SAP ERP HCM (Portugal) VendorSAP Affected 600; 604; 608 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22535
- 2026-10-03 Alias added: GHSA-7xjj-pffv-frqh
References
More SAP Erp Human Capital Management vulnerabilities
- TI-2021-18572 Missing authorization in SAP ERP HCM Portugal CVSS 3.1MEDIUM 4.3
Sources
- CVE-2022-22535 · CVE Program
- CVE-2022-22535 · NVD
- FIRST EPSS
- GHSA-7xjj-pffv-frqh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences