CVE-2026-89124

MediumCVSS 4.3/10Last modified Oct 15, 2026

Description

Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on confidentiality of the data, with no impact on the integrity and availability of the application.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SAP_SE	SAP HANA (Display Product Catalog Based on Customs Declaration)	GTSCORE 200; 300

References

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-891256.0Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative p CVE-2026-8912610.0SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker coul CVE-2026-891285.3Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP w CVE-2026-891295.8Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a CVE-2026-89138.5A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization CVE-2026-891314.3SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthentic CVE-2026-891335.3wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstrain CVE-2026-891349.1A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constra CVE-2026-891356.5A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in e CVE-2026-891368.3When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawP CVE-2026-891384.3The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to th CVE-2026-891398.7Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named sub