CVEvulnerability

CVE-2026-24321

5.3 MEDIUM Published 2026-02-10 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-359

Description

SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.

Affected configurations

• sap commerce cloud 2205 • sap commerce cloud 2211

Related

Weakness · CWE (1)

  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness

References