Read the docs
TI-2022-09568 Aliases CVE-2022-26104GHSA-pwgc-g75r-hxqw

Missing authorization in SAP Financial Consolidation

Priority LOW 25CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message.

Why it matters now

EPSS 0.00705 53rd percentileScored 2026-11-07
Fix Fixed SAP Financial Consolidation (SAP SE): 10.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Financial Consolidationbefore 10.110.1Patch availableCNA
  • SAP Financial Consolidation VendorSAP Affected before 10.1 Fixed in 10.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:financial_consolidation:10.1:*:*:*:*:*:*:*10.1VulnerableSAP
  • cpe:2.3:a:sap:financial_consolidation:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Financial Consolidation (SAP SE) Fixed in 10.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26104
  2. 2026-10-03 Alias added: GHSA-pwgc-g75r-hxqw

References

Advisory 2

  • TI-2019-00303 XML injection in SAP Financial Consolidation CVSS 3.1MEDIUM 6.5
  • TI-2022-19766 Cross-site scripting in SAP Financial Consolidation CVSS 3.1MEDIUM 6.5
  • TI-2022-19768 Cross-site scripting in SAP Financial Consolidation CVSS 3.1MEDIUM 6.1
  • TI-2022-19720 Cross-site scripting in SAP Financial Consolidation CVSS 3.1MEDIUM 5.4
  • TI-2019-00302 Cross-site scripting in SAP Financial Consolidation CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences