Description

SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-11T01:17:23.540Z",
  "pubdate": "2026-08-11T01:17:23.540Z",
  "executiveSummary": "An authorization bypass vulnerability has been identified within the SAP BusinessObjects Business Intelligence Platform (Admin Tools).\nThe vulnerability stems from insufficient authorization checks enforced on specific administrative functionalities within the affected application.\nThe primary impact of this security flaw is limited to a low reduction in confidentiality, with no direct adverse effects on data integrity or system availability.\nTo successfully exploit this security defect, an attacker must first authenticate against the target system using valid credentials associated with a non-administrative user account.\nUpon successful authentication, the malicious actor can leverage the flaw to bypass intended access control restrictions and query limited information regarding the sensitive administrative functionality.\nThe risk implication is constrained by the low impact on confidentiality and the prerequisite of authenticated non-administrative access, yet it represents a breakdown in role-based access control mechanisms within the administrative toolset.\nNo specific version numbers or external exploitation vectors beyond standard authenticated interaction were provided in the baseline description.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate implementation of authorization checks within the SAP BusinessObjects Business Intelligence Platform (Admin Tools) administrative component.\nWhen administrative functionalities are invoked, the underlying application logic fails to properly validate whether the requesting security context possesses the requisite administrative privileges.\nThe affected component is explicitly the Admin Tools module of the SAP BusinessObjects Business Intelligence Platform.\nExploitation requires the attacker to possess prior authentication, specifically holding a valid session or credentials corresponding to a standard, non-administrative user role within the platform.\nThe attack flow proceeds as follows: First, the authenticated non-administrative user establishes a session and interacts with the SAP BusinessObjects Business Intelligence Platform (Admin Tools) interface. Second, the user issues requests targeting administrative endpoints or functions that should normally be restricted to privileged administrators. Third, due to the absence of rigorous server-side authorization enforcement, the application processes the request rather than rejecting it with an unauthorized status code. Finally, the system returns responses containing limited information pertaining to the affected administrative functionality, granting the low-privileged user unauthorized visibility.\nPost-exploitation impact is strictly confined to the exposure of limited administrative information, yielding a low confidentiality breach.\nThere is no mechanism demonstrated for executing arbitrary code, escalating privileges fully to an administrative tier, modifying system configurations (integrity impact), or causing denial of service (availability impact)."
}