CVE-2026-44765

HighCVSS 7.3/10Last modified Oct 23, 2026

Description

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-447666.5SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain funCVE-2026-447676.1setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored aCVE-2026-447684.1SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a CoCVE-2026-447695.5SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing tCVE-2026-44773.1A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPACVE-2026-447704.3SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specificCVE-2026-447714.3SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access informCVE-2026-447749.9Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a CVE-2026-447756.9Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowiCVE-2026-447765.9Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-lCVE-2026-447775.5jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwiseCVE-2026-447782.9Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF