Missing authorization check in CRM-MKT-MPL-TPM, SAP security note 1997788

SAP Note 1997788

SAP security note 1997788, "Missing authorization check in CRM-MKT-MPL-TPM". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of CRM-MKT-MPL-TPM to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached Correction Instruction or the mentioned Support Package.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

References

SAP Note 1971338 – EHP2 for SAP CRM 7.0 – Release & Information Note for SP11

Full note on SAP: SAP Support Launchpad note 1997788

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#CRM-MKT-MPL-TPM #Authorization #Escalation of Privileges

Explore More

SAP Integration Suite and CAP Security Scan | RedRays

July 23, 2026

Product update Clean core is doing its job: custom logic keeps moving off the ABAP stack. But it does not disappear, it

SAP Security Patch Day July 2026 | RedRays

July 14, 2026

SAP has released its July 2026 security patch package containing 19 security notes addressing vulnerabilities across enterprise SAP environments. This release is

SAP Note 3704740: Missing Authorization Check (CVE-2026-27688)

July 6, 2026

SAP Security Note – Deep Dive SAP Note 3704740 closes a missing authorization check in SAP NetWeaver Application Server for ABAP that

SAP Note 3703856: Missing Authorization Check (CVE-2026-24309)

July 6, 2026

SAP Security Note – Patch Advisory SAP Note 3703856 fixes a missing authorization check in the SAP NetWeaver Application Server for ABAP.