CVE-2026-0494

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-04955.1SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which CVE-2026-04966.6SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) withoCVE-2026-04974.3SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. ThisCVE-2026-04987.2SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposeCVE-2026-04996.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflectCVE-2026-05008.8Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker coCVE-2026-05019.9Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could exCVE-2026-05025.4Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attaCVE-2026-05036.4Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extracCVE-2026-05043.8Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially craCVE-2026-05056.1The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This coCVE-2026-05068.1Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an R
CVE-2026-0494: Medium severity, CVSS 4.3 | Vulnix