CVE-2025-42991

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429926.9SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to explCVE-2025-429936.7Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound BindCVE-2025-429947.5SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation iCVE-2025-429957.5SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the CVE-2025-429965.6SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticatCVE-2025-429976.6Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the applicatCVE-2025-429985.3The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 ForbiddCVE-2025-429999.1SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when dCVE-2025-43009.8A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. Affected is an unknown function of the CVE-2025-430007.9Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.ThisCVE-2025-430016.9SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or prCVE-2025-430024.3SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. Th