CVE-2026-44750

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

SAP MDG (Review Match Groups Application) does not perform the necessary authorization checks for authenticated users. This could allow a low-privileged user to perform actions that would otherwise be restricted, resulting in escalation of privileges. This has a low impact on integrity, while confidentiality and availability are not impacted.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-447517.1Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report g CVE-2026-447528.2SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim CVE-2026-447533.7SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable r CVE-2026-447546.6The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identification CVE-2026-447554.3SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users,CVE-2026-4475610.0A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticat CVE-2026-447574.7SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when a CVE-2026-447589.1SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain af CVE-2026-447596.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-44766.3A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file ho CVE-2026-447604.7Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server CVE-2026-447619.1SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration pro