The vulnerability CVE-2026-66764 in SAP S/4HANA's Reprocess Bank Statement Items feature arises from the lack of necessary authorization checks for authenticated users. This flaw allows users to leverage rules that have not been explicitly shared with them, resulting in privilege escalation. The issue is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. Confidentiality impact is low, with no impact on integrity or availability. Affected versions are explicitly 105, 106, 107, 108, and 109. There is no vendor-provided patch or remediation level information available at this time.

Exploiting this vulnerability allows authenticated users to bypass authorization controls and use rules they should not have access to, resulting in privilege escalation. The impact on confidentiality is low, and there is no impact on the integrity or availability of the SAP S/4HANA application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation instructions are currently provided by the vendor. Users should monitor SAP advisories for updates and apply any forthcoming patches promptly.