CVE-2026-89120

HighCVSS 7.1/10Last modified Oct 15, 2026

Description

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-1188

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-891214.7SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business objecCVE-2026-891226.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft CVE-2026-891244.3Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionaliCVE-2026-89138.5A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-conCVE-2026-891335.3wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstrainCVE-2026-891349.1A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraCVE-2026-891356.5A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in eCVE-2026-891368.3When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPCVE-2026-891384.3The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to thCVE-2026-891398.7Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subCVE-2026-89148.4In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsCVE-2026-891406.0Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with w