CVE-2025-42876: SAP S/4 HANA Auth Bypass Vulnerability

CVE-2025-42876 Overview

CVE-2025-42876 is a missing authorization check vulnerability in SAP S/4HANA Private Cloud, specifically within the Financials General Ledger component. An authenticated attacker with authorization limited to a single company code can read sensitive data and post or modify documents across all company codes. The flaw breaks the company code segregation that customers rely on to separate financial activity between legal entities within a single SAP system.

Critical Impact
A low-privileged user scoped to one company code can read general ledger data from every other company code and post or modify financial documents tenant-wide, undermining segregation of duties and financial integrity.

Affected Products

SAP S/4HANA Private Cloud
Financials General Ledger component
Customer deployments relying on company code authorization scoping

Discovery Timeline

2025-12-09 - CVE-2025-42876 published to NVD alongside SAP Security Patch Day
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-42876

Vulnerability Analysis

The vulnerability resides in the General Ledger functionality of SAP S/4HANA Private Cloud. SAP uses the company code (BUKRS) as the primary organizational key that separates accounting books between legal entities in one system. Authorization objects such as F_BKPF_BUK are intended to restrict postings and reads to specific company codes assigned to a user.

In the affected code path, the application fails to enforce that authorization check before reading General Ledger data or processing document operations. An authenticated user who legitimately holds posting rights for one company code can therefore interact with documents belonging to company codes outside their authorization scope.

The weakness is classified under [CWE-405] in the published advisory. The impact profile favors confidentiality, with secondary integrity impact through the ability to post or modify documents. Availability is not affected.

Root Cause

The root cause is an authorization step that is absent from the General Ledger transaction or service handler. The code performs the requested read or write against the persistence layer without first calling the AUTHORITY-CHECK against the company code value supplied in the request. Server-side enforcement of BUKRS scoping is therefore missing for at least one entry point in the General Ledger.

Attack Vector

Exploitation requires network access to the SAP application and valid credentials for any account that already has General Ledger authorization for at least one company code. The attacker submits a General Ledger request referencing a company code outside their assigned scope. Because the authorization object is never evaluated, the backend returns the requested data or accepts the posting. No user interaction is required beyond the attacker's own session.

No public proof-of-concept code has been released, and the issue has not been observed in active exploitation. Technical details are described in SAP Security Note 3672151.

Detection Methods for CVE-2025-42876

Indicators of Compromise

General Ledger document changes (BKPF, BSEG) where the modifying user identity does not hold the authorization profile required for the document's BUKRS value.
Read access to FI reporting transactions returning rows for company codes outside the user's assigned organizational scope.
Unusual posting volume from low-privileged finance users across multiple company codes within a short time window.

Detection Strategies

Compare entries in change document tables (CDHDR, CDPOS) against user-to-company-code authorization mappings exported from SUIM.
Run SAP security audit log (SM20) queries for transactions such as FB01, FB50, FBV0, and related Fiori services, flagging cases where the executed BUKRS is not present in the user's role assignments.
Correlate Fiori and OData traffic for the General Ledger services with the requesting user's HR or role data to identify cross-company-code activity.

Monitoring Recommendations

Forward SAP security audit log, change documents, and read access log entries into a centralized analytics platform for ongoing review.
Alert on first-time access by a user to a company code not previously seen in their activity baseline.
Track posting rates per user per company code and trigger investigation when a user posts to more than their authorized set.

How to Mitigate CVE-2025-42876

Immediate Actions Required

Apply SAP Security Note 3672151 to all affected S/4HANA Private Cloud systems.
Inventory which production, QA, and sandbox systems run the Financials General Ledger component and confirm patch deployment on each.
Review recent General Ledger postings and master data changes for activity that crosses authorized company code boundaries.

Patch Information

SAP released the fix as part of SAP Security Patch Day. The corrective code is delivered through SAP Security Note 3672151, available on the SAP ONE Support Launchpad. Customers should follow the prerequisite and post-installation steps detailed in the note and confirm the kernel and software component levels match the supported patch baseline. Refer to the SAP Security Patch Day Update for the full advisory bundle.

Workarounds

No vendor-supplied workaround replaces the patch; mitigation is to apply SAP Security Note 3672151.
Until patching is complete, tighten role assignments so that the smallest possible population retains General Ledger authorization, and remove redundant or test accounts with finance roles.
Increase frequency of segregation-of-duties reviews and reconcile General Ledger postings against expected company code scopes during the exposure window.

bash

# Verify SAP Security Note 3672151 implementation status
# Run in transaction SNOTE or via report SCWN_NOTE_BROWSER
# Then confirm component patch level in transaction SPAM/SAINT