CVE-2025-26656: OData Service Privilege Escalation Flaw

CVE-2025-26656 Overview

CVE-2025-26656 is a missing authorization vulnerability in the OData service exposed by the SAP Manage Purchasing Info Records application. The service does not verify that an authenticated user holds the required privileges before processing requests. An attacker with valid low-privilege credentials can send crafted OData requests to escalate privileges and modify purchasing information records. The flaw is tracked under CWE-862: Missing Authorization and affects the integrity of purchasing data. Confidentiality and availability are not impacted according to the published scoring.

Critical Impact
An authenticated SAP user can bypass authorization checks in the Manage Purchasing Info Records OData service and perform actions outside their assigned role, affecting the integrity of procurement data.

Affected Products

SAP Manage Purchasing Info Records application
OData service exposed by the Manage Purchasing Info Records Fiori app
Refer to SAP Note #3474392 for the full list of affected component versions

Discovery Timeline

2025-03-11 - CVE-2025-26656 published to the National Vulnerability Database
2025-03-11 - SAP releases security patch via SAP Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26656

Vulnerability Analysis

The vulnerability resides in the OData service backing the SAP Manage Purchasing Info Records application. OData endpoints in SAP Fiori applications typically rely on backend authorization objects to enforce that the caller has the right to read or modify specific business entities. In this case, one or more operations exposed by the service skip the required authorization check. An authenticated session, even one with minimal procurement privileges, is treated as sufficient to invoke protected operations. The result is a vertical privilege escalation path through standard HTTP requests to the OData entity set, with impact limited to the integrity of purchasing info records.

Root Cause

The root cause is a missing authorization check [CWE-862] in the OData service handler. Business logic that creates or modifies purchasing info records does not call the expected AUTHORITY-CHECK against the relevant S_TCODE or purchasing authorization objects before executing the operation. SAP addressed the issue in the correction delivered through SAP Note #3474392.

Attack Vector

Exploitation requires network access to the SAP system and valid user credentials. The attacker authenticates to the SAP Fiori launchpad or directly to the OData gateway, then issues HTTP requests against the Manage Purchasing Info Records entity set. Because the service accepts the request without validating the caller's purchasing authorizations, the attacker can perform state-changing operations reserved for higher-privileged users. User interaction is not required, and the attack complexity is low.

No public proof-of-concept code is available for CVE-2025-26656. Refer to SAP Note #3474392 for vendor-provided technical details.

Detection Methods for CVE-2025-26656

Indicators of Compromise

Unexpected POST, PUT, PATCH, or MERGE requests to the Manage Purchasing Info Records OData entity sets from users without procurement roles
Changes to purchasing info records in change document tables (CDHDR, CDPOS) attributed to accounts that do not normally perform purchasing tasks
SAP Security Audit Log entries showing successful OData calls followed by unexpected business object modifications

Detection Strategies

Enable the SAP Security Audit Log (transaction SM19/RSAU_CONFIG) and capture successful and failed authorization checks for purchasing transaction codes
Review SAP Gateway logs (/IWFND/ERROR_LOG, /IWBEP/ERROR_LOG) for anomalous OData traffic targeting the Manage Purchasing Info Records service
Correlate HTTP access logs from the SAP Web Dispatcher with user role assignments to flag out-of-role access patterns

Monitoring Recommendations

Forward SAP audit, gateway, and change document logs to a central analytics platform for correlation across users and services
Baseline normal OData request volume per user and alert on sudden spikes against the purchasing service
Monitor role assignment changes in AGR_USERS to detect post-compromise persistence attempts

How to Mitigate CVE-2025-26656

Immediate Actions Required

Apply the correction described in SAP Note #3474392 during the next available maintenance window
Review user and role assignments granting access to the Manage Purchasing Info Records Fiori app and revoke access for users that do not require it
Audit recent changes to purchasing info records and reconcile against expected procurement activity

Patch Information

SAP released the fix on SAP Security Patch Day for March 2025. The required support package or correction instructions are documented in SAP Note #3474392. Additional context is published on the SAP Security Patch Day portal.

Workarounds

Restrict access to the Manage Purchasing Info Records OData service at the SAP Gateway using service activation controls in transaction /IWFND/MAINT_SERVICE
Remove the Fiori catalog or group containing the Manage Purchasing Info Records tile from non-procurement business roles until the patch is deployed
Place the SAP Fiori launchpad behind a reverse proxy or Web Application Firewall rule that limits access to the affected OData path to known procurement users

bash

# Example: deactivate the OData service entry via SAP Gateway maintenance
# Transaction: /IWFND/MAINT_SERVICE
# 1. Select the service for Manage Purchasing Info Records
# 2. Choose 'Service Groups Assignment' and remove non-required assignments
# 3. Use 'Delete Service' to deactivate until SAP Note #3474392 is applied