{"vulnerability": "CVE-2026-89112", "sightings": [{"uuid": "3db6df5b-3fde-4e14-b3aa-8aa2167b4e59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89112", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117430916382081123", "content": "CVE-2026-89112 Broken Access Control in CLA-Assistant \ufffd CLA Signature PII Disclosure The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89112https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-8rcv-xqgf-8743https://url.sap/sapsecuritypatchday#SAP_SE #CLA-Assistant#CVE_2026_89112#bot", "creation_timestamp": "2026-10-13T01:06:22.971319Z"}, {"uuid": "33fffdc2-f3ea-4a03-9989-2ade84ebac62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89112", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mxpzebmjty27", "content": "CVE-2026-89112, a broken access control flaw in SAP SE's CLA-Assistant, lets a low-privileged authenticated user read CLA signature records for organisations they do not administer. Versions through 2.13.1 are affected. Upgrade to the patched release.", "creation_timestamp": "2026-10-13T02:47:06.978694Z"}]}