CVE-2026-44770: SAP Create Single Payment Info Disclosure

CVE-2026-44770 Overview

CVE-2026-44770 is a missing authorization vulnerability in the SAP Create Single Payment application. The application fails to perform required authorization checks for authenticated users. A restricted user can access specific entity set keys and retrieve information they are not entitled to view. The flaw is classified under CWE-862: Missing Authorization and impacts confidentiality only, with no impact on integrity or availability. SAP addressed the issue through SAP Note #3713902 as part of the SAP Security Patch Day cycle.

Critical Impact
An authenticated low-privileged user can query restricted entity set keys and disclose payment-related information that should remain inaccessible.

Affected Products

SAP Create Single Payment application
SAP Fiori-based payment processing components exposing the affected entity sets
SAP environments referenced in SAP Note #3713902

Discovery Timeline

2026-07-14 - CVE CVE-2026-44770 published to NVD
2026-07-14 - SAP releases fix via SAP Note #3713902 on SAP Security Patch Day
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-44770

Vulnerability Analysis

The vulnerability exists in the Create Single Payment functionality of SAP. The application authenticates users but does not enforce the authorization checks required before returning entity data. A user with limited privileges can craft requests targeting specific entity set keys. The backend returns records that should be restricted based on the user's role or organizational scope. The flaw is a business-logic authorization gap rather than an injection or memory safety issue. Exploitation requires valid credentials and network access to the SAP endpoint, but no user interaction. The exposed data is limited to information reachable through the vulnerable OData or service endpoint.

Root Cause

The root cause is a missing authorization check [CWE-862] in the request handler for the Create Single Payment service. The handler validates authentication but omits the object-level or field-level authorization check that would restrict access to specific entity set keys. Any authenticated user who can reach the endpoint can request keys outside their assigned scope.

Attack Vector

The attack is network-based and requires low privileges. An authenticated attacker sends crafted requests to the vulnerable service endpoint, iterating or specifying entity set keys of interest. Because the server does not verify whether the caller is authorized for the referenced keys, the response leaks payment-related fields. No social engineering or client-side interaction is required.

No verified exploit code is publicly available for this issue. Refer to SAP Note #3713902 for the authoritative technical description.

Detection Methods for CVE-2026-44770

Indicators of Compromise

Repeated OData or REST requests from a single authenticated session enumerating sequential or varied entity set keys against Create Single Payment endpoints.
HTTP 200 responses returning payment records to user accounts whose SAP roles do not include the corresponding organizational scope.
Unusual read volume from low-privileged accounts against payment-related services outside their normal job function.

Detection Strategies

Enable SAP Security Audit Log (SM19/RSAU_CONFIG) for read events on the Create Single Payment service and correlate accessed keys against the caller's authorization profile.
Deploy application-layer monitoring that flags entity key enumeration patterns and cross-user access anomalies.
Review SAP UI Logging or Read Access Logging (RAL) configurations to record which entity set keys are accessed by which principals.

Monitoring Recommendations

Ingest SAP audit logs and web dispatcher access logs into a centralized SIEM for behavioral baselining of payment service access.
Alert on any account that accesses payment records outside its historical scope or company code assignment.
Track failed and successful authorization checks (return codes) across payment-related function modules to detect gaps.

How to Mitigate CVE-2026-44770

Immediate Actions Required

Apply the SAP-provided fix referenced in SAP Note #3713902 during the next available maintenance window.
Inventory user accounts with access to the Create Single Payment service and validate that authorization objects align with least privilege.
Review audit logs since the affected component was deployed for evidence of unauthorized key access.

Patch Information

SAP released the corrective note as part of SAP Security Patch Day. Customers should download and apply SAP Note #3713902 and consult the SAP Security Patch Day portal for the full patch bundle and prerequisites.

Workarounds

Restrict role assignments so that only users with a documented business need can invoke the Create Single Payment service.
Use SAP Web Dispatcher or reverse proxy rules to limit exposure of the vulnerable endpoint to trusted network segments until patching is complete.
Enable Read Access Logging on the affected entity sets to record and review sensitive field access.

bash

# Configuration example: enable Read Access Logging for sensitive payment fields
# Transaction: SRALMANAGER
# 1. Define log purpose: "Create Single Payment - CVE-2026-44770 monitoring"
# 2. Assign log domain to payment entity sets
# 3. Configure log context (user, timestamp, entity key)
# 4. Activate configuration and review via SRALMONITOR