CVE-2025-42991: SAP S/4HANA Authorization Bypass Vulnerability

CVE-2025-42991 Overview

CVE-2025-42991 is a missing authorization vulnerability in the SAP S/4HANA Bank Account Application. The application does not perform necessary authorization checks when an authenticated user with the approver role deletes attachments. An approver can delete attachments belonging to bank account applications submitted by other users. The flaw is classified under [CWE-862] Missing Authorization and requires network access with low privileges.

Critical Impact
An authenticated approver can delete attachments from other users' bank account applications, causing a low integrity impact without affecting confidentiality or availability.

Affected Products

SAP S/4HANA
SAP S/4HANA Bank Account Application component
SAP Financial Services modules relying on the affected component

Discovery Timeline

2025-06-10 - CVE-2025-42991 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42991

Vulnerability Analysis

The SAP S/4HANA Bank Account Application exposes a delete-attachment operation intended for approver-role users. The application authenticates the caller and checks role membership but does not verify that the target attachment belongs to a bank account application the approver is authorized to modify. This is a classic broken access control condition where role-based authentication is treated as sufficient authorization. The result is horizontal privilege escalation across bank account application records.

Root Cause

The root cause is a missing authorization check [CWE-862] on the attachment-deletion code path. The handler validates that the caller holds the approver role but omits a resource-level ownership or scope check tying the attachment to a record the caller is entitled to act on. Any authenticated approver can therefore target attachments outside their assigned bank account applications.

Attack Vector

Exploitation requires an authenticated session with approver privileges over the network. No user interaction is needed. An attacker with legitimate approver credentials issues a crafted delete-attachment request referencing an attachment identifier bound to another user's bank account application. The server processes the deletion because the authorization check does not correlate the caller with the resource owner. See the SAP Note #3608058 and SAP Security Patch Day advisories for technical specifics.

Detection Methods for CVE-2025-42991

Indicators of Compromise

Attachment-deletion events in the Bank Account Application logs where the acting user does not match the attachment or record owner.
Bursts of delete operations from a single approver account spanning multiple unrelated bank account applications.
User complaints or reconciliation gaps reporting missing supporting documents on submitted bank account applications.

Detection Strategies

Review SAP application-layer audit logs for delete operations against the bank account application attachment service and correlate the acting user identity with the record owner.
Baseline typical approver activity per user and alert on deviations, such as approvers acting on records outside their normal business scope.
Enable and forward SAP Security Audit Log (SM19/SM20) events covering authorization checks and object modifications to a centralized analytics platform.

Monitoring Recommendations

Monitor the Bank Account Application service for high-frequency attachment deletions and repeated failures followed by successes.
Alert on approver accounts performing deletions immediately after unusual logon patterns, geolocation changes, or off-hours access.
Track configuration and role assignment changes to the approver role in SAP Access Control to catch privilege drift.

How to Mitigate CVE-2025-42991

Immediate Actions Required

Apply the SAP-provided patch referenced in SAP Note #3608058 to affected S/4HANA systems.
Review current assignments of the approver role in the Bank Account Application and remove excess privileges.
Audit recent attachment-deletion activity in Bank Account Application logs to identify unauthorized removals.

Patch Information

SAP addressed the missing authorization check as part of the June 2025 SAP Security Patch Day. Administrators must download and apply the correction instructions from SAP Note #3608058. Additional context on the release cycle is available at SAP Security Patch Day. Confirm the patch level with SPAM or the Software Update Manager after deployment.

Workarounds

Restrict the approver role assignment to the minimum set of users required for bank account approval workflows.
Implement compensating access controls in SAP GRC to require dual approval for attachment removal on sensitive bank account applications.
Increase retention and integrity controls on Bank Account Application attachments to enable recovery if unauthorized deletion occurs.

bash

# Configuration example
# Verify implementation of SAP Note #3608058 on the target system
# 1. Log in to the SAP system with administrator privileges
# 2. Run transaction SNOTE and check status for note 3608058
#    Expected status: "Completely implemented"
# 3. Confirm the Security Audit Log is active for authorization failures
#    Transaction: SM19  -> enable filters for AU2 (failed authorization)
#    Transaction: SM20  -> review events for the Bank Account Application user actions