CVE-2025-42899: SAP S4CORE Privilege Escalation Vulnerability

CVE-2025-42899 Overview

CVE-2025-42899 is a missing authorization vulnerability in the SAP S4CORE Manage Journal Entries function. The application fails to enforce authorization checks for an authenticated user, allowing privilege escalation within the affected component. The flaw is categorized under [CWE-862] Missing Authorization. Exploitation requires network access and low privileges, but no user interaction. Successful exploitation grants unauthorized read access to data managed by the journal entries function, with no impact on integrity or availability. SAP published the fix through SAP Note #3530544 as part of its Security Patch Day.

Critical Impact
An authenticated attacker with low privileges can bypass authorization controls in the SAP S4CORE Manage Journal Entries function and access data outside their assigned permissions.

Affected Products

SAP S/4HANA (S4CORE) — Manage Journal Entries function
Refer to SAP Note #3530544 for exact affected support package versions
SAP Security Patch Day advisory lists impacted releases

Discovery Timeline

2025-11-11 - CVE-2025-42899 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42899

Vulnerability Analysis

The vulnerability resides in the SAP S4CORE Manage Journal Entries function within SAP S/4HANA. The application accepts requests from authenticated users but does not verify whether the caller holds the authorization objects required to view the requested journal data. As a result, a low-privileged user can invoke the function and retrieve financial records that should be restricted by role-based authorization.

The issue is a business logic flaw rather than a memory or injection defect. It maps to [CWE-862] Missing Authorization. Because the function returns journal entry data, the impact is limited to confidentiality of financial records surfaced through this specific transaction.

The EPSS probability is 0.247%, indicating a low likelihood of near-term exploitation activity. No public proof-of-concept, exploit code, or in-the-wild activity has been reported at the time of publication.

Root Cause

The root cause is an absent or incomplete authorization check inside the Manage Journal Entries service. SAP applications typically enforce access using authorization objects checked with the AUTHORITY-CHECK statement. In this function, that check is either missing or evaluates an insufficient scope, so the runtime does not gate the data-returning code path on the user's assigned roles.

Attack Vector

The attack vector is network-based and requires an authenticated SAP user account with any low-privilege role that can reach the Manage Journal Entries endpoint. The attacker submits a request to the vulnerable function referencing journal entries or company code data outside their intended authorization scope. Because the application skips the required authorization check, the backend returns the data. No user interaction and no elevated privileges are needed.

No verified exploit code is publicly available. See the SAP Note #3530544 for vendor-provided technical detail.

Detection Methods for CVE-2025-42899

Indicators of Compromise

Requests to Manage Journal Entries services (Fiori apps or OData services under the FAC_JOURNAL_ENTRY namespace) from user accounts that do not hold finance roles.
Unusual volume of journal entry read operations by a single low-privileged SAP user within a short time window.
Access to company codes or ledgers outside a user's assigned organizational scope in the SAP security audit log (SM20).

Detection Strategies

Enable and review the SAP Security Audit Log for RFC and OData calls to journal entry services, focusing on users without the F_BKPF_* authorization objects.
Correlate SAP UAL (User Access Log) and Read Access Logging (RAL) entries against role assignments to identify authorization gaps at runtime.
Ingest SAP audit logs into a SIEM and alert on read access to financial documents by users outside the finance department.

Monitoring Recommendations

Forward SAP Security Audit Log, Gateway log, and OData request logs to a centralized analytics platform for retention and correlation.
Baseline normal journal entry access patterns per user and role, then alert on statistical deviations.
Monitor SAP Note compliance status using SAP Solution Manager or RSECNOTE to confirm SAP Note #3530544 is applied across all systems.

How to Mitigate CVE-2025-42899

Immediate Actions Required

Apply the fix documented in SAP Note #3530544 to all affected SAP S/4HANA systems, prioritizing production and internet-exposed instances.
Review users assigned to roles that grant access to the Manage Journal Entries Fiori app and remove access from users without a business need.
Audit recent access to journal entry data by non-finance users to identify any unauthorized disclosure prior to patching.

Patch Information

SAP released the correction as part of SAP Security Patch Day. Administrators should implement SAP Note #3530544, which contains the required support package or manual correction instructions for affected S4CORE releases. Full details are available at the SAP Security Patch Day Announcement and in the SAP Note #3530544.

Workarounds

Restrict access to the Manage Journal Entries Fiori catalog and related OData services to authorized finance users through PFCG role tuning.
Tighten authorization objects governing journal entry display (for example, F_BKPF_BUK, F_BKPF_BLA) to enforce company code and document type boundaries.
Where feasible, disable the affected OData service in transaction /IWFND/MAINT_SERVICE until the SAP Note can be applied.

bash

# Configuration example: verify SAP Note 3530544 implementation status
# Run in SAP GUI
SE38 -> RSECNOTE
# Or check via Solution Manager System Recommendations
# Then confirm restricted access to the OData service:
/IWFND/MAINT_SERVICE -> filter service: FAC_JOURNAL_ENTRY_SRV
# Review assigned roles and remove non-finance users
PFCG -> role -> Authorizations -> object F_BKPF_BUK / F_BKPF_BLA