CVE-2026-89112: CWE-862: Missing Authorization in SAP_SE CLA-Assistant

The vulnerability identified as CVE-2026-89112 in SAP_SE's CLA-Assistant involves a missing authorization check (CWE-862) in the admin API endpoint responsible for retrieving Contributor License Agreement (CLA) signature records. When the target organisation is specified by organisation ID, the API does not consistently enforce required authorization, allowing authenticated users with limited privileges to access sensitive contributor information from organisations they do not administer. This flaw affects versions up to 2.13.1 and has a CVSS 3.1 base score of 6.5, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality but not integrity or availability.

An authenticated user with limited privileges can access CLA signature records containing contributor information for organisations they are not authorized to administer. This results in unauthorized disclosure of sensitive contributor data, impacting confidentiality. There is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor SAP's advisories for updates. Until a fix is available, restrict access to the affected API endpoint to trusted users only and review user privileges to minimize exposure.