---
id: CVE-2026-89112
title: >-
  The admin API endpoint used to retrieve CLA signature records does not
  consistently enforce the required authorization checks when the target
  organisation is specified using an organisation ID.An authenticated user with
  limited privilege…
summary: >-
  The admin API endpoint used to retrieve CLA signature records does not
  consistently enforce the required authorization checks when the target
  organisation is specified using an organisation ID.An authenticated user with
  limited privilege…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T03:16:41.230'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89112'
references:
  - url: >-
      https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-8rcv-xqgf-8743
    label: cna@sap.com
  - url: 'https://url.sap/sapsecuritypatchday'
    label: cna@sap.com
  - url: >-
      https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-8rcv-xqgf-8743
    label: cna@sap.com
tags:
  - nvd
ingestedAt: '2026-10-13T02:12:00.762Z'
---

## Overview

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.