This vulnerability (CVE-2026-0502) in SAP BusinessObjects Business Intelligence Platform arises from inadequate CSRF protections. It allows an attacker to coerce an authenticated user into submitting unintended requests, potentially altering application state or availability. The CVSS 3.1 score is 5.4 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and no confidentiality impact but low integrity and availability impacts. Affected versions include ENTERPRISE 430, 2025, and 2027. No patch or official remediation level has been disclosed by the vendor.

The vulnerability could allow an attacker to cause an authenticated user to perform unintended actions on the SAP BusinessObjects Business Intelligence Platform, impacting the integrity and availability of the application at a low level. There is no impact on confidentiality. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious with authenticated sessions and avoid interacting with untrusted links or sites that could exploit CSRF. Monitor SAP's advisories for updates on patches or mitigations.