ST-PI Missing Authorization: CVE-2026-109808 · CVSS 3.0 3.1 · SAP Note 3802244
Note 3802244 adds a missing authorization check to a remote-enabled function module in the SAP Solution Tools Plug-In (ST-PI). An authenticated user who knows specific internal identifiers could read data they should not see. SAP rates this issue at CVSS 3.1, Low. In this post, we cover exposure, the fix and what to check.
ST-PI Missing Authorization: fix
The ST-PI Missing Authorization affects ST-PI 2008_1_700, 2008_1_710, 740 and 758. So implement the correction instructions or the ST-PI support package. ST-PI sits on nearly every ABAP system, because Solution Manager and SAP Cloud ALM use it. Therefore, the fix is easiest to roll out as part of regular ST-PI updates.
Why a low score still matters
The impact stays limited, and the attacker needs a valid user and internal identifiers. However, ST-PI is everywhere. As a result, this issue exists in almost every landscape until someone updates the plug-in.
Remote-enabled functions
Remote-enabled function modules are a common source of missing authorization checks. For example, any user with broad S_RFC rights can call them. Therefore, this issue is another reason to keep S_RFC narrow for dialog and technical users.
What to check
First, check the ST-PI version on each system, for example in the component information of the system status. Next, schedule the ST-PI update with your regular maintenance. In addition, include the plug-in in your Solution Manager or Cloud ALM update plan. Finally, review S_RFC authorizations, which limit this risk and similar bugs in other plug-ins.
ST-PI Missing Authorization: advisory details
Component: SV-SMG-SDD
SAP priority: Low
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 3
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: SAP Security Note 3802244 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
