Enterprise Portal CSRF: CVE-2026-89131 · CVSS 3.0 4.3 · SAP Note 3801587
Note 3801587 adds CSRF protection to Enterprise Portal endpoints that perform state-changing actions. Without it, an attacker could get a logged-on user to click a link that triggers an unintended action. As a result, the attacker could change non-sensitive information. SAP rates the Enterprise Portal CSRF at CVSS 4.3, Medium. In this post, we cover exposure, the fix and what to check.
Enterprise Portal CSRF: fix
The Enterprise Portal CSRF fix covers EP-BASIS, EP-BASIS-API, EP-RUNTIME and EP-ADMIN 7.50. So deploy the support package patch. In addition, Enterprise Portal already had three fixes in October (Notes 3779985, 3789825 and 3790401). Keeping the portal on a current support package therefore pays off.
How the attack works
The attacker prepares a page or link that sends a request to the portal. When a logged-on user opens it, the browser adds the user’s session automatically. Consequently, this issue lets the attacker act with that user’s rights, within the limits of the affected endpoints.
Why the score is low
The affected endpoints only change non-sensitive information, and the attack needs user interaction. For that reason, SAP rates this issue as Medium. Still, CSRF bugs often combine with other weaknesses, so do not leave it unpatched.
What to check
First, confirm the support package level of all portal components. Next, plan the patch together with the other portal fixes of the last two months. Finally, review whether the portal is reachable from the internet, since that widens the audience for this attack.
Enterprise Portal CSRF: advisory details
Component: EP-PIN-NAV
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: SAP Security Note 3801587 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
