CVE-2026-0511
Published: 13 January 2026
Summary
CVE-2026-0511 is a high-severity Missing Authorization (CWE-862) vulnerability in Sap (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-0511 is a missing authorization vulnerability (CWE-862) in the SAP Fiori App Intercompany Balance Reconciliation. The application fails to perform necessary authorization checks for authenticated users, enabling privilege escalation. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high impact on confidentiality and integrity with no effect on availability. The vulnerability was published on 2026-01-13.
An authenticated attacker with low privileges can exploit this issue remotely over the network with low complexity and no user interaction required. Successful exploitation allows escalation of privileges, potentially granting unauthorized access to sensitive data and enabling modifications that compromise the application's confidentiality and integrity.
SAP has addressed this vulnerability through security note 3565506, available at https://me.sap.com/notes/3565506, as part of the SAP Security Patch Day detailed at https://url.sap/sapsecuritypatchday. Security practitioners should apply the recommended patches promptly to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2378
Vulnerability details
SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,availability is not impacted.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) directly enables remote privilege escalation from low-priv authenticated access in a network-exposed SAP Fiori web app.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates enforcement of approved authorizations for access to information and resources, addressing the core issue of missing authorization checks enabling privilege escalation in the SAP Fiori app.
Employs the principle of least privilege to restrict authenticated users to only necessary accesses, mitigating the high confidentiality and integrity impacts from privilege escalation.
Requires timely identification, reporting, and correction of flaws like the missing authorization vulnerability, enabling application of SAP security note 3565506 to prevent exploitation.