Introduction
An attacker who gains database administrator rights in a business-critical ERP system can manipulate financial records, exfiltrate sensitive data, or disrupt operations. CVE-2025-42951 is a newly disclosed vulnerability in the System Landscape Directory (SLD) of SAP Business One. It lets authenticated users bypass authorization and gain administrative database privileges through specific API calls.
About SAP and SAP Business One: SAP SE is one of the largest enterprise software vendors in the world, with more than 400,000 customer organizations. SAP Business One is its flagship ERP product for small and midsize enterprises and handles core business functions such as finance, inventory, and sales. The System Landscape Directory (SLD) is the central component that manages system configuration and database connectivity in SAP Business One deployments.
Technical information
CVE-2025-42951 is classified under CWE-863 (Incorrect Authorization). The flaw is in the SLD component of SAP Business One, where certain API endpoints do not properly enforce authorization checks. When an authenticated user sends requests to these endpoints, the SLD does not verify whether that user has the privileges needed to perform administrative database actions. Any authenticated user with network access to the SLD API can therefore escalate their privileges to database administrator.
Because the SLD holds the configuration and connectivity information for SAP Business One systems, its administrative database functions should be limited to users with explicit administrator roles. Here the authorization logic is either missing or incorrectly implemented, so a user can escalate privileges by misusing the API. No public code snippets or PoC are available for this vulnerability.
The attack requires:
- Valid authentication credentials for SAP Business One
- Network access to the SLD API endpoints
No information is available about the specific API paths or request formats. Unauthenticated users cannot exploit the vulnerability.
Affected systems and versions
- Product: SAP Business One (System Landscape Directory component)
- Specific affected versions are not disclosed in public sources as of this writing
- All SAP Business One deployments with SLD enabled and accessible to authenticated users are potentially at risk
Vendor security history
SAP has a history of authorization and authentication vulnerabilities in Business One:
- CVE-2023-31403: Improper access control in SAP Business One allowed unauthorized SMB share access
- CVE-2022-28771: Missing authentication in License service API
SAP issues monthly security updates and has improved its patch response time. Even so, the repeated authorization flaws in Business One show that access control remains an ongoing problem for the product.
