CVE-2026-24318

MediumCVSS 4.2

Published: 14/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

An insecure session management vulnerability in SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to obtain valid session tokens and reuse them to gain unauthorized access to a victim's session. If the application keeps accepting previously issued tokens after authentication, the attacker can assume the victim's authenticated context.

Risk Assessment

An attacker can access or modify information within the victim's session scope, impacting confidentiality and integrity.

Recommendation

Apply SAP fixes that invalidate session tokens upon re-authentication. Implement token revocation and rotation mechanisms.

Other vulnerabilities in SAP Business Objects Business Intelligence Platform

CVE-2026-44755Medium
SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters from authenticated users, resulting in an email spoofing vulnerability. This has low impact on integrity and does not affect confidentiality or availability.

Original NVD description (English source)

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously issued tokens after authentication, the attacker could assume the victim�s authenticated context. This could allow the attacker to access or modify information within the victim�s session scope, impacting confidentiality and integrity, while availability remains unaffected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS