PT-2026-32551 · Sap Se · Sap Businessobjects Business Intelligence Platform

Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-24318

Mitre

CVSS v3.1

4.2

Medium

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously issued tokens after authentication, the attacker could assume the victim�s authenticated context. This could allow the attacker to access or modify information within the victim�s session scope, impacting confidentiality and integrity, while availability remains unaffected.

Fix

Weakness Enumeration

CWE-539

Related Identifiers

CVE-2026-24318

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-24318 · Security Note
• https://twitter.com/CVEnew/status/2043976170346045513 · Twitter Post
• https://twitter.com/CVEarity/status/2044031612904722565 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3702191 · Note