Missing Auth in SAP S/4 HANA Private Cloud - Cross-Company Data Leak
CVE-2025-42876 Published on December 9, 2025

Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)
Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could result in a high impact to confidentiality and a low impact to integrity, while availability remains unaffected.

NVD

Vulnerability Analysis

CVE-2025-42876 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is an Amplification Vulnerability?

Software that does not appropriately monitor or control resource consumption can lead to adverse system performance. This situation is amplified if the software allows malicious users or attackers to consume more resources than their access level permits. Exploiting such a weakness can lead to asymmetric resource consumption, aiding in amplification attacks against the system or the network.

CVE-2025-42876 has been classified to as an Amplification vulnerability or weakness.


Products Associated with CVE-2025-42876

Want to know whenever a new CVE is published for SAP S4hana? stack.watch will email you.

 

Affected Versions

SAP_SE SAP S/4 HANA Private Cloud (Financials General Ledger):

Exploit Probability

EPSS
0.05%
Percentile
14.01%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.