CVE-2026-89124 · CVSS 3.0 4.3 · SAP Note 3810872
A user allowed into a customs workflow should still be limited to the information their role permits. SAP Note 3810872 corrects missing checks in Display Product Catalog Based on Customs Declaration in SAP Global Trade Services, edition for SAP HANA.
The issue is unauthorized reading
A low-privileged authenticated user can access sensitive information outside their intended authorization scope. SAP rates CVE-2026-89124 at 4.3, Medium priority. The attack is network-based and requires no other user’s interaction. SAP reports low confidentiality impact, with no integrity or availability impact. The note does not describe changing customs declarations or product data.
GTSCORE 200 and 300
These are the component releases listed in the advisory. Apply the supplied correction instructions or the relevant support package: SAPK-20008INGTSCORE for GTSCORE 200 and SAPK-30002INGTSCORE for GTSCORE 300. The correction makes the restricted information dependent on the required permissions.
Test the denied case
A useful acceptance check needs two business users with different intended access scopes. Confirm that an authorized user can still display the required catalog information and that a restricted user cannot read beyond their assigned scope. Use approved test data and record the role differences with the result. A successful display test performed only as an administrator cannot show whether the authorization boundary is working.
Advisory details
Component: FT-LEG-CUS-MDT
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: SAP Security Note 3810872 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
