{"id":"CVE-2026-120014","kind":"vulnerability","aliases":["CVE-2026-120014"],"related":[],"title":"SAP HANA XSA Web Dispatcher: admin requests lack validation, enabling forged actions","description":"SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a temporary compromise of the SAP HANA XSA Web Dispatcher, resulting in a high impact on confidentiality, and partial impact on integrity, and availability.","summary":"SAP HANA XSA Web Dispatcher does not validate requests in some administrative functions. An attacker who tricks a logged-on administrator into opening a malicious link can cause unintended actions in that admin's session, with high impact on confidentiality and partial impact on integrity and availability.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP HANA XSA Web Dispatcher","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["admin-ui","csrf","infrastructure","sap-hana","web-dispatcher","xsa"],"not_affected_if":[],"how_to_check":"Look up SAP Security Note 3804858 (SAP for Me, login required) for the exact affected builds. A CVE-record mirror lists affected components as WEBDISP 7.93 and 9.16, KERNEL 7.93, 9.20 and 9.21, and XS_ADVANCED_RUNTIME 1.00. Not read on SAP's own page. Check whether your HANA XSA Web Dispatcher admin interface is reachable by administrators who browse the web while logged on.","fix":null,"status":"open","published_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","triaged_at":"2026-11-10T01:28:20+00:00","updated_at":"2026-11-10T01:33:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T01:28:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SAP HANA XSA Web Dispatcher: admin requests lack validation, enabling forged actions","impact":"high","summary":"SAP HANA XSA Web Dispatcher does not validate requests in some administrative functions. An attacker who tricks a logged-on administrator into opening a malicious link can cause unintended actions in that admin's session, with high impact on confidentiality and partial impact on integrity and availability.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sap-hana","xsa","web-dispatcher"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker performs admin actions, partial compromise of dispatcher","analyst_note":"Find SAP's security note and the affected/fixed versions for CVE-2026-120014 and the specific admin functions named there.","how_to_check":"- unknown","plain_action":"","product_name":"SAP HANA XSA Web Dispatcher","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running SAP HANA XSA Web Dispatcher with administrative functions in use are exposed when an administrator can be lured to a malicious link. The sources do not name affected versions or the specific administrative functions involved. unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4632,"output_tokens":510,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note and the affected/fixed versions for CVE-2026-120014 and the specific admin functions named there.","search":"'-120014':15A,18A '-2026':14A,17A 'action':12A,66B,129C 'admin':6A,25B,69B 'admin-ui':24B 'administr':47B,57B,97C,117C,132C 'attack':50B,110C 'avail':83B,163C 'caus':64B,127C 'certain':96C 'compromis':142C 'confidenti':76B,156C 'context':101C 'could':111C,126C,137C 'csrf':27B 'cve':13A,16A 'dispatch':5A,34B,40B,88C,107C,149C 'dispatcher':23A 'enabl':10A 'exploit':136C 'forg':11A 'function':48B,98C 'hana':2A,20A,31B,37B,85C,104C,146C 'high':73B,153C 'impact':74B,79B,154C,159C 'infrastructur':28B 'integr':81B,161C 'lack':8A 'lead':138C 'link':62B,122C,125C 'log':55B,115C 'logged-on':54B,114C 'malici':61B,121C 'open':59B 'partial':78B,158C 'perform':91C 'request':7A,44B,93C 'result':150C 'sap':1A,19A,30B,36B,84C,103C,145C 'sap-hana':29B 'session':71B,134C 'success':135C 'suffici':92C 'temporari':141C 'trick':52B,112C 'ui':26B 'unauthent':109C 'unintend':65B,128C 'valid':9A,43B,94C 'visit':119C,123C 'web':4A,22A,33B,39B,87C,106C,148C 'web-dispatch':32B 'xsa':3A,21A,35B,38B,86C,105C,147C","nicknames":[],"mitigations":[],"who_affected":"Teams running SAP HANA XSA (XS Advanced) with its Web Dispatcher admin functions are exposed if an administrator who is logged on can be lured to a malicious link (a CSRF, CWE-352; the attacker needs no account but the admin must click). Exact versions and the named admin functions come from SAP Note 3804858, which is behind SAP login and was not read. Teams without XSA or the Web Dispatcher admin interface can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hanaxsawebdispatcher","saphanaxsawebdispatcher"],"ptokens":["dispatcher","hana","sap","web","xsa"],"labels":["adminui","csrf","high","infrastructure","saphana","vendor","webdispatcher","xsa"],"campaign_type":null,"search_a":"'-120014':15A,18A '-2026':14A,17A 'action':12A 'admin':6A 'cve':13A,16A 'dispatch':5A 'dispatcher':23A 'enabl':10A 'forg':11A 'hana':2A,20A 'lack':8A 'request':7A 'sap':1A,19A 'valid':9A 'web':4A,22A 'xsa':3A,21A","search_b":"'action':66B 'admin':25B,69B 'admin-ui':24B 'administr':47B,57B 'attack':50B 'avail':83B 'caus':64B 'confidenti':76B 'csrf':27B 'dispatch':34B,40B 'function':48B 'hana':31B,37B 'high':73B 'impact':74B,79B 'infrastructur':28B 'integr':81B 'link':62B 'log':55B 'logged-on':54B 'malici':61B 'open':59B 'partial':78B 'request':44B 'sap':30B,36B 'sap-hana':29B 'session':71B 'trick':52B 'ui':26B 'unintend':65B 'valid':43B 'web':33B,39B 'web-dispatch':32B 'xsa':35B,38B","search_c":"'action':129C 'administr':97C,117C,132C 'attack':110C 'avail':163C 'caus':127C 'certain':96C 'compromis':142C 'confidenti':156C 'context':101C 'could':111C,126C,137C 'dispatch':88C,107C,149C 'exploit':136C 'function':98C 'hana':85C,104C,146C 'high':153C 'impact':154C,159C 'integr':161C 'lead':138C 'link':122C,125C 'log':115C 'logged-on':114C 'malici':121C 'partial':158C 'perform':91C 'request':93C 'result':150C 'sap':84C,103C,145C 'session':134C 'success':135C 'suffici':92C 'temporari':141C 'trick':112C 'unauthent':109C 'unintend':128C 'valid':94C 'visit':119C,123C 'web':87C,106C,148C 'xsa':86C,105C,147C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120014","severity":null,"published_at":"2026-11-10T01:17:16+00:00","modified_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","fetched_at":"2026-11-10T01:26:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120014:2385","url":"https://hol.org/guard/security/cves/CVE-2026-120014-cross-site-request-forgery-csrf-vulnerability-in","severity":null,"published_at":"2026-11-10T01:33:45+00:00","modified_at":"2026-11-10T01:33:45+00:00","first_seen_at":"2026-11-10T01:33:45+00:00","fetched_at":"2026-11-10T01:33:45+00:00","note":"CNA is SAP (CVSS 7.6, CSRF CWE-352). SAP note 3804858 (Nov 2026 Patch Day) is login-gated, and the public November patch day page was not yet available. Affected components came only from a CVE-record mirror (hol.org), so nothing is marked verified. Fix version unknown; revisit when the SAP patch day page is published. Not exploited per sources.","cites":["https://hol.org/guard/security/cves/CVE-2026-120014-cross-site-request-forgery-csrf-vulnerability-in","https://nvd.nist.gov/vuln/detail/CVE-2026-120014"]}],"documents":[{"id":112457,"url":"https://hol.org/guard/security/cves/CVE-2026-120014-cross-site-request-forgery-csrf-vulnerability-in","title":"HOL Guard record for CVE-2026-120014 (mirrors CVE List V5, cites SAP note 3804858)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112458,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120014","title":"NVD CVE-2026-120014","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}