A missing authorization check in SAP NetWeaver Application Server for ABAP allows an authenticated attacker to execute a specific ABAP function module that reads sensitive information from the database catalog. While the vulnerability does not affect integrity or availability, it permits read‑only access to sensitive data, resulting in a low confidentiality impact.

The affected product is SAP NetWeaver Application Server for ABAP. No specific version information is provided in the advisory; the issue applies to all releases of this product until the fix is applied.

The CVSS score of 3.5 reflects low severity, and the EPSS score is below 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reducing urgency. An attacker must be authenticated, so the attack vector requires valid user credentials. The risk is therefore limited to users with legitimate access rights, who could exploit the missing check to read the database catalog.