CVE-2026-27676

CVE-2026-27676 affects SAP S/4HANA’s OData Service (Manage Technical Object Structures). The vulnerability arises from missing authorization checks, enabling an attacker to update and delete child entities via exposed OData endpoints. Impact is described as low for integrity, with no impact on co...

CVE-2025-23191

Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the atom:link values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacke...

CVE-2025-23191

CVE-2025-23191 describes a cache-poisoning vulnerability in the SAP OData endpoint of SAP Fiori for SAP ERP . By modifying the HTTP GET Host header, an attacker can corrupt cached values and alter the atom:link metadata, redirecting clients to attacker-controlled links. The documented impact is d...