CVE-2026-27672

Vulnerability

Details The Material Master application in SAP fails to enforce authorization checks for authenticated users when executing reports. This missing access control allows users to access report functionality without proper entitlement validation, leading to information disclosure.

Exploitation

An authenticated user can exploit this vulnerability by simply executing reports that should require additional authorization. No special privileges or network position are required beyond standard user access to the application. The attack vector is through the application's reporting interface.

Impact

Successful exploitation results in the disclosure of sensitive material master data. The confidentiality impact is low, as per the CVSS score, and there is no impact on integrity or availability of the system. The vulnerability does not allow data modification or denial of service.

Mitigation

SAP has addressed this vulnerability through its Security Patch Day process. Administrators should apply the relevant SAP Security Note as soon as possible. For detailed information and patch availability, refer to SAP Security Notes in SAP for Me [1].