Missing authorization check in CO-PA, SAP security note 1860367

SAP Note 1860367

SAP security note 1860367, "Missing authorization check in CO-PA". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of CO-PA to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement support package or correction instructions.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

Full note on SAP: SAP Support Launchpad note 1860367

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization Check #CO-PA #Escalation of Privileges #SAP Security

Explore More

SAP Integration Suite and CAP Security Scan | RedRays

July 23, 2026

Product update Clean core is doing its job: custom logic keeps moving off the ABAP stack. But it does not disappear, it

SAP Security Patch Day July 2026 | RedRays

July 14, 2026

SAP has released its July 2026 security patch package containing 19 security notes addressing vulnerabilities across enterprise SAP environments. This release is

SAP Note 3704740: Missing Authorization Check (CVE-2026-27688)

July 6, 2026

SAP Security Note – Deep Dive SAP Note 3704740 closes a missing authorization check in SAP NetWeaver Application Server for ABAP that

SAP Note 3703856: Missing Authorization Check (CVE-2026-24309)

July 6, 2026

SAP Security Note – Patch Advisory SAP Note 3703856 fixes a missing authorization check in the SAP NetWeaver Application Server for ABAP.