---
id: CVE-2026-89112
title: >-
  The admin API endpoint used to retrieve CLA signature records does not
  consistently enforce the required authorization checks when the target
  organisation is specified using an organisation ID.An authenticated user with
  limited privilege…
summary: >-
  The admin API endpoint used to retrieve CLA signature records does not
  consistently enforce the required authorization checks when the target
  organisation is specified using an organisation ID.An authenticated user with
  limited privilege…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: SAP_SE
product: CLA-Assistant
affected:
  - CLA-Assistant <= v2.13.1
published: '2026-10-13'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T20:38:04.303'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89112'
references:
  - url: >-
      https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-8rcv-xqgf-8743
    label: cna@sap.com
  - url: 'https://url.sap/sapsecuritypatchday'
    label: cna@sap.com
  - url: >-
      https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-8rcv-xqgf-8743
    label: cna@sap.com
tags:
  - nvd
  - cve.org
epss: 0.00209
epssPercentile: 0.10895
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T13:00:22.838453Z'
ingestedAt: '2026-10-13T02:12:00.762Z'
---

## Overview

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.