The SAP Fiori App for Intercompany Balance Reconciliation allows high‑privileged users to upload files and send them to any email address that the application can reach, effectively turning the application into a tool for delivering malicious content or phishing messages. Although the reported impact on confidentiality, integrity and availability is low, the ability to produce deceptive attachments or credentials constitutes a significant threat. The flaw is a case of improper authorization (CWE‑15) that lets privileged users bypass normal email sending restrictions.

The vulnerability affects the SAP Fiori App for Intercompany Balance Reconciliation from SAP SE. No specific product versions are listed, so any current deployment of this application may be vulnerable until an official update or patch is applied.

With a CVSS score of 5.1 and an EPSS score of less than 1 %, the risk level is moderate and the likelihood of exploitation is low but not zero. The CVE is not listed in the CISA Knowledge Exploited Vulnerabilities catalog, and no publicly known exploits are reported. Because the attack requires high‑privilege access to the Fiori application, it represents an internal attack vector; attackers could use the exposed file‑upload feature to send arbitrary attachments to arbitrary email addresses, enabling phishing campaigns against internal or external recipients.