SAP SE (5 apps) (com.sap.fsm, com.sap.mobile.apps.a): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for SAP SE (5 apps).
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
SAP SE (5 apps)
XETRA
2026-06-21
95d ago
Substantive
Critical
An app used by field engineers working on power grids, water systems and industrial plants bundles a Chinese push-notification SDK with background GPS tracking, a combination subject to China's National Intelligence Law. The same hardcoded-credential mistake shows up identically across all five SAP apps audited, meaning SAP's build process has never been checked for this class of error, and a separate HR app requests microphone access, contact-writing and screen-overlay permissions with no clear business need. SAP engaged faster and more specifically than any other target this year, conceded two of eleven tickets, then closed the rest with one sentence naming no finding.
FSM, JAM, Asset Manager, Mobile Start, SuccessFactors. C1: Baidu Push SDK (315 smali) in SAP FSM, CVSS v4.0 base HIGH/8.7, held at CRITICAL under an explicit blast-radius escalation because the affected devices belong to field engineers with physical access to power grids, water systems, and industrial plants. C2: Firebase API keys hardcoded across all 5 apps, CVSS v4.0 CRITICAL/9.3, fifteen individually named abuse paths never addressed. H1 (Dynatrace, undisclosed Art. 28 processor), H2 (RECORD_AUDIO/WRITE_CONTACTS/SYSTEM_ALERT_WINDOW in the HR app), and H3 (AD_ID in the B2B field-service app) all corrected to MEDIUM/6.9 CVSS v4.0 in the final report. 11 tickets registered by SAP PSRT (PSINC0012180–PSINC0012194), two conceded outright (H3, M1). SAP stated the matter "resolved and closed" on 9 September 2026 without naming a single finding. Case published 24 September 2026, three days after the 21 September embargo, an internal publishing gap, not a change in terms.
click to expand
GDPR Art. 28GDPR Chapter VPRC NSL+2
Yes
Closed
Disclosure
95d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.