CVE-2026-0511

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,availability is not impacted.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-05126.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthentica CVE-2026-05134.7Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker cou CVE-2026-05146.1Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When CVE-2026-05156.2Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutri CVE-2026-05166.5A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host CVE-2026-05177.5CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially cra CVE-2026-05184.8CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileg CVE-2026-05193.4In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain config CVE-2026-05202.8A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authentic CVE-2026-05216.1A reflected cross-site scripting (XSS) vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated at CVE-2026-05228.8A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbit CVE-2026-05287.5Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Mani