{"id":"CVE-2026-109808","kind":"vulnerability","aliases":["CVE-2026-109808"],"related":[],"title":"SAP Solution Tools Plug-In: missing check lets logged-in users read restricted data","description":"Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.","summary":"SAP Solution Tools Plug-In has a remote-enabled function that skips an authorization check. An authenticated attacker who already knows certain internal identifiers can call it and read data they should not see.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP Solution Tools Plug-In","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["sap","solution-tools-plug-in","vendor"],"not_affected_if":["auth-required","default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","triaged_at":"2026-11-10T01:29:03+00:00","updated_at":"2026-11-10T01:29:03+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T01:29:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP Solution Tools Plug-In: missing check lets logged-in users read restricted data","impact":"low","summary":"SAP Solution Tools Plug-In has a remote-enabled function that skips an authorization check. An authenticated attacker who already knows certain internal identifiers can call it and read data they should not see.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","solution-tools-plug-in"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads restricted sensitive information from SAP system","analyst_note":"Check SAP Security Notes for affected and fixed plug-in versions and the remote-enabled function names; the NVD entry does not list them.","how_to_check":"- unknown","plain_action":"","product_name":"SAP Solution Tools Plug-In","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Organizations running SAP systems with the Solution Tools Plug-In installed and remote-enabled functions reachable by authenticated users. The attacker needs valid credentials and prior knowledge of specific internal identifiers, so exposure depends on who holds accounts. The sources do not say which plug-in versions are affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000717,"input_tokens":4625,"output_tokens":508,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-109808':19A,22A '-2026':18A,21A 'access':99C 'affect':128C 'allow':90C,133C 'alreadi':57B 'attack':55B,93C,115C,135C 'authent':54B,92C 'author':51B,76C 'avail':154C 'call':63B 'certain':59B,79C,111C 'check':8A,52B,77C 'condit':112C 'confidenti':146C 'could':132C 'cve':17A,20A 'data':16A,67B,100C 'due':72C 'enabl':46B,82C 'exploit':106C,131C 'function':47B,83C,97C,129C 'identifi':61B,123C 'impact':144C,150C 'in':28A 'inform':139C 'integr':152C 'intern':60B,122C 'invok':95C 'know':58B 'knowledg':119C 'let':9A 'log':11A 'logged-in':10A 'low':143C 'miss':7A,75C 'must':116C 'otherwis':103C 'plug':5A,27A,33B,40B,88C 'plug-in':4A,26A,39B,87C 'possibl':109C 'prior':118C 'read':14A,66B,137C 'remot':45B,81C 'remote-en':44B,80C 'restrict':15A,105C 'result':140C 'sap':1A,23A,29B,36B,84C 'see':71B 'sensit':138C 'skip':49B 'solut':2A,31B,37B,85C 'solution':24A 'solution-tools-plug-in':30B 'specif':121C 'success':125C,130C 'target':126C 'tool':3A,32B,38B,86C 'tools':25A 'user':13A 'vendor':35B 'would':102C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP systems with the Solution Tools Plug-In installed and remote-enabled functions reachable by authenticated users. The attacker needs valid credentials and prior knowledge of specific internal identifiers, so exposure depends on who holds accounts. The sources do not say which plug-in versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["sapsolutiontoolsplugin","solutiontoolsplugin"],"ptokens":["in","plug","sap","solution","tools"],"labels":["low","sap","solutiontoolsplugin","vendor"],"campaign_type":null,"search_a":"'-109808':19A,22A '-2026':18A,21A 'check':8A 'cve':17A,20A 'data':16A 'in':28A 'let':9A 'log':11A 'logged-in':10A 'miss':7A 'plug':5A,27A 'plug-in':4A,26A 'read':14A 'restrict':15A 'sap':1A,23A 'solut':2A 'solution':24A 'tool':3A 'tools':25A 'user':13A","search_b":"'alreadi':57B 'attack':55B 'authent':54B 'author':51B 'call':63B 'certain':59B 'check':52B 'data':67B 'enabl':46B 'function':47B 'identifi':61B 'intern':60B 'know':58B 'plug':33B,40B 'plug-in':39B 'read':66B 'remot':45B 'remote-en':44B 'sap':29B,36B 'see':71B 'skip':49B 'solut':31B,37B 'solution-tools-plug-in':30B 'tool':32B,38B 'vendor':35B","search_c":"'access':99C 'affect':128C 'allow':90C,133C 'attack':93C,115C,135C 'authent':92C 'author':76C 'avail':154C 'certain':79C,111C 'check':77C 'condit':112C 'confidenti':146C 'could':132C 'data':100C 'due':72C 'enabl':82C 'exploit':106C,131C 'function':83C,97C,129C 'identifi':123C 'impact':144C,150C 'inform':139C 'integr':152C 'intern':122C 'invok':95C 'knowledg':119C 'low':143C 'miss':75C 'must':116C 'otherwis':103C 'plug':88C 'plug-in':87C 'possibl':109C 'prior':118C 'read':137C 'remot':81C 'remote-en':80C 'restrict':105C 'result':140C 'sap':84C 'sensit':138C 'solut':85C 'specif':121C 'success':125C,130C 'target':126C 'tool':86C 'would':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109808","severity":null,"published_at":"2026-11-10T01:17:15+00:00","modified_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","fetched_at":"2026-11-10T01:26:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}