Introduction
Deleting business-critical data from SAP systems can halt operations and lead to costly recovery work. CVE-2025-42916 lets a privileged attacker delete the contents of arbitrary database tables in SAP environments where authorization groups are not properly configured. This summary covers how the flaw works, which configurations are affected, and the parts of SAP's security history that relate to it.
SAP SE is the largest enterprise software provider globally, with over 440,000 customers and a dominant presence in ERP, CRM, and business intelligence. Its ABAP stack runs many core business processes. Because the stack is complex and central to enterprise IT, it is a frequent target for both security researchers and attackers.
Technical Information
CVE-2025-42916 is caused by missing input validation in SAP ABAP reports. ABAP reports typically accept user-supplied parameters that control which data is selected and how it is processed. If the report does not properly validate these parameters, a user with high privileges can supply crafted input that makes it delete data from database tables. The flaw is exploitable only when the target table is not protected by an authorization group.
SAP implements authorization groups through the S_TABU_DIS authorization object and the DICBERCLS field. Administrators assign tables to authorization groups in transaction SE54. If a table is not assigned to any group, its access controls may be bypassed, and a vulnerable ABAP report can then run destructive operations against it.
The vulnerability is classified under CWE-1287 (Improper Validation of Specified Type of Input). No public code snippets or proof of concept are available.
Affected Systems and Versions
- Vulnerable: SAP systems running ABAP reports, but only where database tables are not protected by authorization groups.
- Not vulnerable: systems where every table is assigned to an authorization group.
- Versions: as of this writing, public advisories list no specific product versions or version ranges.
Vendor Security History
SAP has a history of repeated critical vulnerabilities in its ABAP stack. Examples include:
- CVE-2025-42957: ABAP code injection in SAP S/4HANA
- CVE-2025-42951: Authorization bypass in SAP Business One SLD
- Multiple input validation and authorization flaws fixed in recent monthly patch cycles
SAP releases patches on a monthly schedule and works with external researchers. Even so, critical ABAP and authorization issues appear often enough to point to ongoing problems in secure development and configuration.
