CVE-2026-0513

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site.This causes low impact on integrity of the application. Confidentiality and availability are not impacted.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
SAP_SE	SAP Supplier Relationship Management (SICF Handler in SRM Catalog)	SRM_SERVER 700; 701; 702; 713; 714

References

https://me.sap.com/notes/3638716Permissions Required
https://url.sap/sapsecuritypatchdayPatch, Vendor Advisory

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-05146.1Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When CVE-2026-05156.2Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutri CVE-2026-05166.5A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host CVE-2026-05177.5CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially cra CVE-2026-05184.8CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileg CVE-2026-05193.4In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain config CVE-2026-05202.8A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authentic CVE-2026-05216.1A reflected cross-site scripting (XSS) vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated at CVE-2026-05228.8A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbit CVE-2026-05287.5Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Mani CVE-2026-05296.5Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-CVE-2026-05306.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially