CVE-2020-26809

SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.

• CWE-276

• http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/27Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2975189Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory
• http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/27Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2975189Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory

Published

Nov 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26803In Sentrifugo 3.2, users can upload an image under "Assets -…8.8
• CVE-2020-26804In Sentrifugo 3.2, users can share an announcement under "Or…8.8
• CVE-2020-26805In Sentrifugo 3.2, admin can edit employee's informations vi…7.2
• CVE-2020-26806admin/file.do in ObjectPlanet Opinio before 7.15 allows Unre…8.8
• CVE-2020-26807SAP ERP Client for E-Bilanz, version - 1.0, installation set…3.3
• CVE-2020-26808SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1…7.2
• CVE-2020-2681Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5
• CVE-2020-26810SAP Commerce Cloud (Accelerator Payment Mock), versions - 18…7.5
• CVE-2020-26811SAP Commerce Cloud (Accelerator Payment Mock), versions - 18…5.3
• CVE-2020-26814SAP Process Integration (PGP Module - Business-to-Business A…4.9
• CVE-2020-26815SAP Fiori Launchpad (News tile Application), versions - 750,…8.6
• CVE-2020-26816SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.…4.5