CVE-2026-40132: Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)
Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This vulnerability also enables the attacker to change the default settings and modify value fields, which will mislead risk evaluations and falsely lower assessed risk levels. This results in a low impact on the confidentiality and integrity of the data. There is no impact on the application�s availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40132?
CVE-2026-40132 has been classified as a high severity vulnerability due to its potential for unauthorized information access.
How do I fix CVE-2026-40132?
To mitigate CVE-2026-40132, ensure that authorization checks are properly implemented in the SAP Balanced Scorecard Wizard application.
What is the impact of CVE-2026-40132?
The impact of CVE-2026-40132 allows authenticated attackers to access sensitive information without proper authorization.
Who is affected by CVE-2026-40132?
CVE-2026-40132 affects users of the SAP Strategic Enterprise Management Balanced Scorecard Wizard application.
Is there a patch available for CVE-2026-40132?
Yes, SAP provides security patches to address CVE-2026-40132, and users should apply them promptly.