SAP SOLUTION TOOLS PLUG-IN · CVE-2026-109808 · Vendor
NO FIX YET
SAP Solution Tools Plug-In has a remote-enabled function that skips an authorization check. An authenticated attacker who already knows certain internal identifiers can call it and read data they should not see.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP systems with the Solution Tools Plug-In installed and remote-enabled functions reachable by authenticated users. The attacker needs valid credentials and prior knowledge of specific internal identifiers, so exposure depends on who holds accounts. The sources do not say which plug-in versions are affected.
Not affected if auth-required, default-config
Who cares sap, solution-tools-plug-in
Unknown from the sources.
No fix yet, per the sources.
Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.