Authenticated users with high privileges on SAP BusinessObjects Business Intelligence Platform can embed arbitrary URLs in the application. When a victim clicks such a link, the system performs an unvalidated redirect to a domain controlled by the attacker, permitting delivery of malicious content. The consequence is a breach of confidentiality and integrity of the application, while availability remains unaffected.

SAP BusinessObjects Business Intelligence Platform versions 2025, 2027 and 430 enterprise editions are affected. A patch is available through SAP Note 3674246 and the SAP Security Patch Day updates.

The vulnerability scores a CVSS of 7.3 (High) and has an EPSS of less than 1%, indicating a low probability of exploitation in the wild and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to have authenticated access with elevated privileges; the attacker then must insert a malicious link that a target user later clicks. While it does not provide remote code execution or denial‑of‑service, it facilitates phishing and can be used as a foothold for further credential or data theft.