CVE-2026-109808
Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)
Description
Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
INFO
Published Date :
Nov. 10, 2026, 12:40 a.m.
Last Modified :
Nov. 10, 2026, 12:40 a.m.
Remotely Exploit :
Yes !
Source :
sap
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | LOW | e4686d1a-f260-4930-ac4c-2f5c992778dd |
Solution
- Apply SAP Security Note updates immediately.
- Review and strengthen authorization controls.
- Validate access to sensitive data.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-109808 vulnerability anywhere in the article.