CVE-2026-0505

The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cna@sap.com

Published

2026-02-10

Last modified

2026-02-10

Weaknesses

CWE-79

Affected products

• Document Management System (Sap)
• Erp (Sap)
• S4core (Sap)
• Sap Document Management System (Sap Se)

References

• https://me.sap.com/notes/3678417
• https://url.sap/sapsecuritypatchday