Description

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-11T01:17:21.180Z",
  "pubdate": "2026-08-11T01:17:21.180Z",
  "executiveSummary": "A Missing Authorization Check vulnerability has been identified within SAP Manufacturing Integration and Intelligence (MII). This security flaw exposes scheduling-related application functions to unauthenticated remote attackers due to the absence of proper authorization validation mechanisms during function execution.\nSuccessful exploitation of this vulnerability grants unauthorized threat actors the capability to interact with application-managed scheduling data. An attacker can execute CRUD operations—specifically retrieving, creating, modifying, or deleting sensitive scheduling records—without possessing valid administrative or operational privileges.\nWhile the overall impact on system confidentiality, integrity, and availability is categorized as low, the unauthorized manipulation of manufacturing schedules can disrupt operational workflows and compromise data integrity within industrial environments.\nThe vulnerability requires network connectivity to the affected SAP Manufacturing Integration and Intelligence instance, but does not necessitate prior authentication or user interaction, lowering the barrier for remote exploitation by unauthenticated adversaries on accessible network segments.",
  "technicalDetails": "The root cause of this vulnerability lies in the inadequate implementation of access control enforcement within the scheduling-related application functions of SAP Manufacturing Integration and Intelligence. Specifically, the vulnerable component fails to validate whether incoming requests originate from an authenticated and authorized session before processing operational logic.\nThe affected product is SAP Manufacturing Integration and Intelligence, specifically targeting internal application functions responsible for managing scheduling data. The attack vector is strictly remote, operating over the network without requiring any prior authentication credentials or privileged access rights from the malicious actor.\nThe step-by-step attack flow initiates when an unauthenticated remote attacker crafts and transmits malicious HTTP requests or procedural invocations directly to the exposed scheduling endpoints within SAP Manufacturing Integration and Intelligence. Because the application logic lacks proper authorization checks at the entry point of the function handlers, the request bypasses security validation gates.\nUpon receiving the payload, the vulnerable backend component processes the request as if it were legitimate and authorized. This permits the remote adversary to execute unauthorized actions, including the retrieval of internal scheduling configurations, the creation of fraudulent schedule entries, the modification of existing operational timelines, or the complete deletion of critical scheduling data.\nPost-exploitation impact is constrained to the scope of application-managed scheduling data. While direct system compromise or remote code execution is not inherently facilitated by this specific flaw, the unauthorized alteration or destruction of scheduling datasets directly impacts operational reliability, data integrity, and situational awareness within the manufacturing intelligence environment."
}