CVE-2025-23190: SAP Authorization Bypass Vulnerability

CVE-2025-23190 Overview

CVE-2025-23190 is a missing authorization check vulnerability [CWE-862] in an SAP remote-enabled function module. An authenticated attacker can invoke the function module and read data that would normally be restricted by application-level access controls. The flaw does not allow modification of data or affect system availability, limiting the impact to confidentiality only. SAP addressed the issue as part of its monthly Security Patch Day release cycle.

Critical Impact
An authenticated attacker with low privileges can remotely call the affected function module over the network to disclose data outside their normal authorization scope.

Affected Products

SAP application component addressed in SAP Note #3547581
Specific product name and versions are not enumerated in the NVD record
Refer to the SAP Security Patch Day announcement for the impacted release list

Discovery Timeline

2025-02-11 - CVE-2025-23190 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-23190

Vulnerability Analysis

The vulnerability resides in a remote-enabled function module (RFM) exposed through the SAP Remote Function Call (RFC) interface. RFMs are callable by any authenticated user who can reach the RFC endpoint, and each module is expected to perform its own authorization checks against the invoking user's roles. In this case the module omits that check, so the SAP kernel returns data without verifying that the caller holds the required authorization objects.

Because the attacker must already hold valid credentials, exploitation typically requires either a compromised business account or an insider with baseline access to the SAP system. Impact is limited to unauthorized disclosure of data. The module does not permit write operations, and calling it does not degrade system performance.

Root Cause

The root cause is a missing AUTHORITY-CHECK statement, or an equivalent authorization object validation, inside the ABAP implementation of the remote-enabled function module. Under SAP's shared-responsibility model, the developer of an RFM must explicitly verify that the caller is entitled to the requested data before returning it. Without that check, the module trusts the transport-layer authentication and skips business-level access control.

Attack Vector

Exploitation occurs over the network through the RFC protocol or an RFC-exposed web service such as SOAP or OData wrappers. The attacker authenticates with valid SAP credentials, then issues a function call to the vulnerable RFM with crafted input parameters that request records outside the attacker's assigned scope. The server executes the function and returns the data. No user interaction and no elevated privileges are required beyond a standard authenticated session. Technical details are described in SAP Note #3547581.

Detection Methods for CVE-2025-23190

Indicators of Compromise

Unexpected RFC calls to the function module identified in SAP Note #3547581 from user accounts that do not normally use it
Anomalous volume of read requests from a single authenticated user against sensitive tables reachable through the RFM
RFC gateway logs showing calls originating from workstations or hosts outside typical business patterns

Detection Strategies

Enable SAP Security Audit Log (SM19/RSAU_CONFIG) events for successful and failed RFC function calls
Correlate RFC call logs with the affected user's assigned authorization roles to surface access outside expected scope
Ingest SAP audit and gateway logs into a SIEM for baseline analysis of RFM invocation patterns

Monitoring Recommendations

Alert on first-time invocation of the affected function module by any user account
Track spikes in data volume returned by RFC calls from a single session
Review SAP UCON (Unified Connectivity) allowlists to detect RFMs newly reachable from external clients

How to Mitigate CVE-2025-23190

Immediate Actions Required

Apply the SAP security patch referenced in SAP Note #3547581 to affected systems
Review the SAP Security Patch Day bulletin to confirm the impacted product and support package levels
Rotate credentials for any service accounts observed calling the vulnerable module without a business justification

Patch Information

SAP released the fix through its regular Security Patch Day process. Administrators should download and apply the correction from SAP Note #3547581 following standard change management. Consult the SAP Security Patch Day Announcement for the full list of notes released alongside CVE-2025-23190.

Workarounds

Use SAP Unified Connectivity (UCON) to block or restrict external RFC access to the affected function module until the patch is applied
Tighten authorization role assignments so fewer users can reach the RFC interface exposing the module
Enforce network segmentation between untrusted clients and SAP application servers hosting the RFC gateway

bash

# Configuration example
# Review SAP Note #3547581 for the exact correction instructions and
# apply through SPAM/SAINT or the SAP Software Update Manager (SUM).