What is CVE-2025-42949?

CVE-2025-42949 is a medium-severity vulnerability in Sap Se Abap Platform, classified under Missing Authorization. CVSS score: 4.9/10. Published 2025-08-12.

How severe is CVE-2025-42949?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Is CVE-2025-42949 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Sap Se Abap Platform

CVE-2025-42949

Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.

Vulnerability class: Broken Access Control

EPSS: 0.003 (23.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Sap_se Abap Platform — versions SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 916

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

Frequently asked questions

What is CVE-2025-42949?: CVE-2025-42949 is a medium-severity vulnerability in Sap Se Abap Platform, classified under Missing Authorization. CVSS score: 4.9/10. Published 2025-08-12.
How severe is CVE-2025-42949?: Medium severity. CVSS v3 base score is 4.9 out of 10.
Is CVE-2025-42949 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.