CVE-2026-58237
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity, with no impact on availability.
Risk Assessment
The risk includes unauthorized access to sensitive information and the ability to make limited changes, which could compromise data confidentiality.
Recommendation
It is recommended to strengthen authorization checks in SAP Approuter WebSocket, restrict access to sensitive functions, and apply security patches.
Original NVD description (English source)
WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.