CVE-2026-27687

CVE-2026-27687: A missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal allows a user with high privileges to access another company’s sensitive data. Root cause: lack of authorization validation. Impact: High confidentiality impact; no reported integrity or availabilit...

CVE-2026-27687: Missing Authorization

Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges could access sensitive data belonging to another company. This vulnerability has a high impact on confidentiality and does not affect integrity and availability...

EUVD-2019-1098

Malware in sbrugna...

SAP ERP HCM and SAP S/4HANA Authorization Issues Vulnerability

SAP ERP HCM and SAP S/4HANA are both products of SAP, an enterprise human resource management solution, and SAP S/4HANA, an enterprise resource management software based on the SAP HANA in-memory database system. SAP ERP HCM and SAP S/4HANA have an authorization issue vulnerability that stems fro...

CVE-2022-22535

SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause...

CVE-2019-0325

SAP ERP HCM SAPHRCES , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain...

CVE-2022-22535: Missing Authorization

SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause...

PT-2021-23496

Name of the Vulnerable Software and Affected Versions SAP ERP HCM Portugal affected versions not specified Description The issue is related to a report that reads payroll data of employees in a certain area, where necessary authorization checks are not performed. This allows an attacker to read...

CVE-2021-42062: Missing Authorization

SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts...

CVE-2019-0325: Missing Authorization

SAP ERP HCM SAPHRCES , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain...

SAP ERP HCM CVE-2019-0325 Remote Authorization Bypass Vulnerability

Description SAP ERP HCM Basis is prone to an authorization-bypass vulnerability. Attackers can exploit this issue to gain unauthorized access and obtain sensitive information. This may aid in further attacks. Technologies Affected SAP ERP HCM 3.0 Recommendations Block external access at the netwo...

PT-2019-4585

Name of the Vulnerable Software and Affected Versions SAP ERP HCM SAP HRCES version 3 Description The issue arises from insufficient authorization checks in a report that reads payroll data of employees in a certain area. This can lead to a situation where a user who once had authorization to...

PT-2018-15590

Name of the Vulnerable Software and Affected Versions SAP Fiori 1.0 for SAP ERP HCM Approve Leave Request, version 2 Description The issue is due to insufficient CSRF protection, allowing an attacker to trick an authenticated user into sending an unintended request to the web server...

CVE-2018-2474: Cross-Site Request Forgery (CSRF)

SAP Fiori 1.0 for SAP ERP HCM Approve Leave Request, version 2 application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection...