SAP SE CLA Assistant vulnerabilities

2 vulnerabilities

Known vulnerabilities in SAP SE CLA Assistant, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2026-89112sap_secla-assistant
EPSS score
0.21%
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.6.5CVE-2021-21471sap_secla-assistant+1
EPSS score
0.74%
In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application.