← Vulnerability feed

Vulnerability record · CVE-2020-6188 · published 12 February 2020

CVE-2020-6188: Sap erp missing authorization vulnerability

Sap · Erp

VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check.

8.8 CVSS 3.1 High EPSS 0.68% · top 49.7% CWE-862 · Missing authorization
8.8CVSS 3.1 base score, v2 6.5
0.68%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://launchpad.support.sap.com/#/notes/2857511 Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 Vendor Advisory
https://launchpad.support.sap.com/#/notes/2857511 Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 Vendor Advisory

Track CVE-2020-6188 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.6CVE-2020-26832Sap netweaver application server abap missing authorization vulnerabilitySAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and S…EPSS 2.2%7.2CVE-2026-0498Sap s\/4 hana code injection vulnerabilitySAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC…EPSS 0.47%6.5CVE-2024-34691Sap s\/4 hana missing authorization vulnerabilityManage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalati…EPSS 0.28%6.1CVE-2026-24323Sap document management system open redirect vulnerabilityThe BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sa…EPSS 0.21%6.1CVE-2026-0505Sap document management system cross-site scripting vulnerabilityThe BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could resul…EPSS 0.22%5.4CVE-2020-6212Sap erp missing authorization vulnerabilityEgypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and…EPSS 0.65%5.4CVE-2020-6199Sap erp missing authorization vulnerabilityThe view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate…EPSS 0.33%5.3CVE-2024-45282Sap s\/4 hana vulnerabilityFields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property …EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2020-6188), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.