CVE-2026-66772

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-667735.9A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application,CVE-2026-667743.7SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default CVE-2026-667754.3SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker coul CVE-2026-667765.9SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An CVE-2026-667775.9SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity CVE-2026-667785.3SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated at CVE-2026-667796.3Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malic CVE-2026-66785.3Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.CVE-2026-667806.5A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, posse CVE-2026-667815.4A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPse CVE-2026-667825.8A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer t CVE-2026-667834.4A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a c