The SAP Fiori App for Intercompany Balance Reconciliation fails to perform the required authorization checks for an authenticated user, allowing that user to climb privileges and access data or functions beyond their intended rights. This flaw corresponds to CWE‑862: Missing Authorization and can compromise both confidentiality and integrity of the application’s data, while availability remains unaffected. Based on the description, the attacker must already have authenticated credentials, so the vulnerability is exploitable within the context of a legitimate user account.

The affected product is the SAP Fiori App (Intercompany Balance Reconciliation) from SAP SE. No additional vendor or version details are supplied in the current data, so any installation of this application is potentially vulnerable.

With a CVSS score of 8.1 the vulnerability is classified as high severity. The EPSS score is < 1%, indicating a low current probability of exploitation, and the issue is not listed in CISA’s KEV catalog. However, because the flaw can be triggered by any authenticated user without additional preconditions, the risk remains significant for systems where privileged or broad authorizations are assigned. The lack of explicit remote access prerequisites suggests that the attack vector is local or within the authenticated user’s session.