CVE-2026-66772: SAP BusinessObjects Auth Bypass Flaw

CVE-2026-66772 Overview

CVE-2026-66772 affects the SAP BusinessObjects Business Intelligence Platform Admin Tools. The platform fails to enforce sufficient authorization checks on specific administrative functionality. An attacker who is authenticated as a non-administrative user can bypass this restriction to gain limited information about the affected functionality.

The vulnerability maps to [CWE-862] Missing Authorization. Exploitation requires network access and valid low-privilege credentials but no user interaction. Successful exploitation results in a limited disclosure of information, with no impact on integrity or availability of the platform.

Critical Impact
Authenticated non-administrative users can access restricted administrative functionality and disclose limited information about that functionality.

Affected Products

SAP BusinessObjects Business Intelligence Platform
Admin Tools component of the BI Platform
Refer to SAP Note #3770649 for the authoritative list of affected releases

Discovery Timeline

2026-08-11 - CVE-2026-66772 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66772

Vulnerability Analysis

The vulnerability resides in the Admin Tools component of the SAP BusinessObjects Business Intelligence Platform. Specific administrative functionality performs an incomplete authorization check when handling requests from authenticated sessions. The application authenticates the caller but does not consistently verify that the caller holds the administrative role required to invoke the functionality.

An attacker with any valid non-administrative account can send requests to the affected functionality. The server processes the request and returns limited information that should be restricted to administrators. The disclosed information is bounded, which limits the confidentiality impact to a low rating. The flaw does not permit modification of data or disruption of the service.

This class of weakness, catalogued as [CWE-862] Missing Authorization, is common in platforms that separate authentication from role enforcement across many discrete endpoints. When developers add administrative endpoints without a centralized authorization filter, coverage gaps appear.

Root Cause

The root cause is a missing or incomplete server-side role check on selected administrative operations in the Admin Tools code path. Authorization is expected at the role level, but the affected handlers rely only on session authentication. Any authenticated principal, regardless of role, therefore passes the check.

Attack Vector

The attack vector is network-based over the standard BusinessObjects interfaces. The attacker must possess valid credentials for a non-administrative account. The attacker sends requests to the affected admin functionality directly, without needing to escalate privileges within the platform or interact with a legitimate administrator.

No public proof-of-concept code has been published for CVE-2026-66772. See SAP Note #3770649 for the vendor's technical description of the affected endpoints.

Detection Methods for CVE-2026-66772

Indicators of Compromise

Requests to BusinessObjects Admin Tools endpoints originating from user accounts that do not hold the Administrator role
Repeated HTTP 200 responses to administrative URLs from low-privilege sessions where HTTP 403 would be expected
Anomalous enumeration patterns from a single authenticated session sweeping administrative paths

Detection Strategies

Compare authenticated user roles against the endpoints accessed in BusinessObjects access logs to identify role-endpoint mismatches
Baseline normal Admin Tools traffic by role, then alert on non-administrator sessions reaching those routes
Correlate CMS audit events with web tier logs to attribute administrative API calls to the invoking principal

Monitoring Recommendations

Enable BusinessObjects auditing for administrative actions and forward events to a centralized logging platform
Monitor for privilege-mismatch events across the SAP BI landscape and retain logs for post-incident review
Track authentication anomalies for service accounts and low-privilege users that historically do not touch Admin Tools

How to Mitigate CVE-2026-66772

Immediate Actions Required

Apply the SAP-issued patch referenced in SAP Note #3770649 to all affected BusinessObjects BI Platform installations
Review the SAP Security Patch Day bulletin at SAP Security Patch Day for related fixes released in the same cycle
Audit non-administrative accounts on the BI Platform and remove unnecessary or dormant users

Patch Information

SAP has issued a security fix for CVE-2026-66772 through SAP Note #3770649. The note contains the corrected authorization logic and the list of Support Package levels that include the fix. Customers should log in to the SAP for Me portal to retrieve the patch and follow SAP's standard patch application procedure for the BusinessObjects Business Intelligence Platform.

Workarounds

Restrict network access to BusinessObjects Admin Tools endpoints to administrative subnets using firewall or reverse-proxy rules
Reduce the population of authenticated users on the affected system until the patch is deployed
Increase log retention and alerting on Admin Tools access as a compensating control until patching is complete

bash

# Example: restrict Admin Tools URL paths at a reverse proxy until patched
# Replace <admin_cidr> with your administrative network range
location /BOE/CMC/ {
    allow <admin_cidr>;
    deny all;
    proxy_pass http://boe_backend;
}