Executive brief
SAP Approuter, a routing component used to forward and authorize requests to backend services, fails to properly validate certain incoming requests before processing them. An attacker with low-level access could craft specially designed requests to bypass authorization checks, gaining access to protected resources they should not reach. This could allow unauthorized reading of sensitive data and limited modifications to protected resources.
Technical details
The vulnerability is an authorization bypass (CWE-284 / broken access control) in SAP Approuter's request validation logic. The root cause lies in insufficient validation of certain incoming requests before they are forwarded to backend destinations. An attacker with low privileges can send specially crafted requests that evade authorization checks due to the complexity of the validation conditions. The attack is network-reachable and does not require additional user interaction. Successful exploitation allows reading of sensitive data and performing limited modifications on protected resources. Patches are available through SAP Security Notes as part of SAP's regular patch day cycle.
Affected products
- SAP Approuter
Timeline
- 2026-08-11: disclosed