Medium 4.3

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against...

CVE-2026-89131 First seen on SecPulse Nov 10, 09:36

Original description The description as published by the source.

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 09:36
GHSA: GHSA-hvj4-mfr9-mvpv
CWE: CWE-352

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Cross-Site Request Forgery

CWE

CWE-352

All

Sap Se Sap Netweaver Enterprise Portal

Detection sources

NIST National Vulnerability Database07:11
GitHub Security Advisories (Global)Nov 10, 12:30
CVE.org (CVE Program・cvelistV5)05:46