Missing Authorization Check in RFC Enabled Function Module RSWR_DB_DATA_DELETE

August 5, 2026

Missing Authorization Check in RFC Enabled Function Module RSWR_DB_DATA_DELETE


Impact on Business

An authenticated attacker could delete data from the RSWR_DATA table, which stores runtime data for user personalization and bookmarks in the Business Explorer (BEx) tool. This could lead to the loss of user-specific configurations, metrics, and a decrease in user productivity within the SAP Business Warehouse environment.


Vulnerability Details

The RFC-enabled function module RSWR_DB_DATA_DELETE fails to perform adequate authorization checks. This allows an authenticated user with low privileges to remotely trigger the deletion of entries in the RSWR_DATA table. This table is used by the Business Explorer (BEx) for storing personalization settings and web application bookmarks.


Solution

SAP has released SAP Note 3608991 which provides patched versions of the affected components.

The patches can be downloaded from https://me.sap.com/notes/3608991.

Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.


Report Timeline

  • 03/28/2025: Onapsis reports vulnerability to SAP
  • 07/08/2025: SAP issues the patch

References


Advisory Information

  • Public Release Date: 08/05/2026
  • Security Advisory ID: ONAPSIS-2026-00010
  • Researcher(s): Adrian Radulescu

Vulnerability Information

  • Vendor: SAP
  • Affected Components: SAP NetWeaver ABAP, SAP Business Warehouse (BEx) (Check SAP Note 3608991 for detailed information on affected releases)
  • Vulnerability Class: CWE-284: Improper Access Control
  • CVSS v3 score: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
  • Risk Level: Medium
  • Assigned CVE: CVE-2025-42960
  • Vendor patch Information: SAP Security NOTE 3608991

Affected Components Description

The vulnerability affects SAP Business Warehouse (BEx) components within SAP NetWeaver ABAP environments. Specifically, it involves the remote-enabled function module RSWR_DB_DATA_DELETE.

About our Research Labs

Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications. Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.

Find all reported vulnerabilities at: https://github.com/Onapsis/vulnerability_advisories

This advisory is licensed under a Creative Commons 4.0 BY-ND International License

Back To Advisories

Further Reading

Advisory

Missing Authorization Check in SAP NetWeaver

Missing Authorization Check in SAP NetWeaver Impact on Business A remote attacker with low privileges can enumerate all users in the current system client. This information disclosure aids in gathering valid usernames which could be used in subsequent attacks, such as password brute-forcing or social engineering, potentially increasing the attack surface of the system. Vulnerability…

Read More
Advisory

Missing Authorization and Information Disclosure in SAP Business Warehouse

Missing Authorization and Information Disclosure in SAP Business Warehouse Impact on Business A remote attacker can retrieve detailed configuration information about the SAP system and the underlying operating system. This information disclosure could aid an attacker in planning further attacks by identifying specific versions and configurations of the target environment. Vulnerability Details The remote-enabled function…

Read More
Advisory

Missing Authorization and Information Disclosure in RFC Enabled Function Module CMO_COLLECT_INFO_RFC_DEST

Missing Authorization and Information Disclosure in RFC Enabled Function Module CMO_COLLECT_INFO_RFC_DEST Impact on Business A remote authenticated attacker can discover detailed information about installed software components and their versions on the application server. This information disclosure aids in fingerprinting the system, potentially facilitating further attacks by identifying specific vulnerable components. This has a low impact…

Read More