A Cross‑Site Request Forgery (CSRF) vulnerability in the SAP Fiori App Intercompany Balance Reconciliation allows an attacker to perform state‑changing operations on behalf of an authenticated user if an inappropriate request type is used. The deviation from expected request semantics could trigger unintended actions, leading to a low‑level impact on the integrity of the system while leaving confidentiality and availability untouched.

SAP SE – SAP Fiori App Intercompany Balance Reconciliation. No specific impacted versions are listed in the CNA data, so all released versions of the app should be examined.

The CVSS score of 4.3 reflects the low impact and limited exploitation potential. The EPSS score of less than 1% indicates a very low probability of real‑world exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Despite the low risk, exploitation would typically occur through a crafted web request sent from the victim’s browser, leveraging the user’s authenticated session. No explicit prerequisites beyond a valid session are disclosed, so the attack vector is presumed to be a typical web‑based CSRF scenario.