CVE-2026-89121 · CVSS 3.0 4.7 · SAP Note 3799621
SAP Note 3799621 fixes an authorization mismatch between Linear Asset Management business objects and associated data. A low-privileged user with local access could modify data for objects they were not authorized to change. SAP assigns CVSS 4.7 and Medium priority.
Integrity drives this finding
The CVSS vector specifies local access and high attack complexity. The reported consequence is high integrity impact, with no confidentiality or availability impact. Those conditions matter when explaining the issue: the advisory does not describe an anonymous Internet-facing modification endpoint.
The correction follows the parent object
SAP extends authorization checks for Read, Modify and Create operations so that Linear Asset Management business objects follow the parent business object’s authorization concept. The affected component is S4CORE 109. Apply the correction instructions or support package SAPK-10903INS4CORE.
Use business-object permissions in the test plan
Check both allowed and denied operations against associated data, using users whose access differs on the parent object. Include ordinary read and create workflows as well as changes, because SAP identifies all three operations in the correction. This note is listed in SAP for Me as a Support Package Security Note released on 13 October 2026. It is covered alongside the day’s Patch Day entries to keep the full release-date inventory visible.
Advisory details
Component: PM-LAM
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 4
CVSS vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: SAP Security Note 3799621 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
