CVE-2024-27900: SAP ABAP Platform Authorization Bypass Flaw

CVE-2024-27900 Overview

CVE-2024-27900 is a missing authorization vulnerability in SAP ABAP Platform versions 758 and 795. An attacker with a valid business user account can change the privacy setting of job templates from shared to private without proper authorization checks. When exploited, the affected template becomes accessible only to the owner, blocking other legitimate users from using shared templates. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated business users can hijack ownership visibility of shared job templates, disrupting collaboration and scheduled workloads that depend on shared template access.

Affected Products

SAP ABAP Platform version 758
SAP ABAP Platform version 795
Environments using shared job template functionality

Discovery Timeline

2024-03-12 - CVE-2024-27900 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27900

Vulnerability Analysis

The vulnerability resides in the job template management functionality of the SAP ABAP Platform. The application exposes an operation that toggles a template's visibility between shared and private states. This operation does not verify whether the requesting user holds the authorization required to modify that specific template's privacy attribute.

Any authenticated business user can invoke the operation against templates owned by other users. Once flipped to private, the template is restricted to the owner's account, breaking downstream jobs and workflows that reference it. Confidentiality of the template contents remains unaffected, but integrity of the shared configuration is compromised.

Root Cause

The root cause is an absent authorization check ([CWE-862]) on the privacy-setting handler. The handler trusts the authenticated session and processes the state change without evaluating the caller's ownership or role assignments for the target template object. This is a classic broken access control pattern in a business application context.

Attack Vector

Exploitation is network-based and requires a valid business user account on the target SAP ABAP Platform instance. No user interaction is required. The attacker issues a standard application request to modify the template privacy attribute for a target template identifier. Because the affected functionality is part of the standard job template UI and API surface, no specialized tooling is required beyond authenticated access.

No public proof-of-concept exploit code is available in Exploit-DB or referenced advisories.

Detection Methods for CVE-2024-27900

Indicators of Compromise

Unexpected transitions of job templates from shared to private visibility state
Job template privacy modifications performed by user accounts that are not the template owner or a designated administrator
Batch job failures or scheduling errors caused by templates that are no longer accessible to their previous consumers

Detection Strategies

Enable and review SAP Security Audit Log (SM19/SM20) events tied to job template management transactions
Correlate template modification events with the user's role assignments to flag actions outside expected authorization scope
Baseline normal template administration activity and alert on modifications occurring outside change windows or from atypical accounts

Monitoring Recommendations

Ingest SAP application and audit logs into a centralized SIEM for retention and analytics
Alert on repeated template privacy changes performed by the same non-owner account across multiple templates
Track failed batch job executions that reference templates recently switched to private

How to Mitigate CVE-2024-27900

Immediate Actions Required

Apply SAP Security Note #3419022 to affected ABAP Platform 758 and 795 systems
Inventory job templates and validate their current privacy state against expected configuration
Review business user role assignments and remove template administration privileges from accounts that do not require them

Patch Information

SAP addressed the missing authorization check in the fix delivered through SAP Note #3419022. Refer to the SAP Security Notes Overview for the full advisory and applicable support package levels for versions 758 and 795.

Workarounds

Restrict access to the job template management transactions and services to a limited administrative role until the patch is applied
Monitor and periodically re-validate the visibility state of business-critical shared templates
Establish a manual approval process for template privacy changes on production systems pending patch deployment

bash

# Verify SAP Note 3419022 application status via SNOTE transaction
# Transaction: SNOTE
# Menu: Goto -> SAP Note Browser
# Filter: Note Number = 3419022
# Expected status: Completely implemented