The vulnerability arises from the SAP Customer Checkout application storing operational data locally with reversible protection mechanisms. When a user initiates certain interactions, those operations can modify the stored data without proper validation, allowing unauthorized changes that can affect system behavior during startup. This scenario compromises the application's confidentiality and integrity, but has a low impact on availability.

SAP Customer Checkout 2.0. No specific version details are provided, so all releases of this product are potentially affected until an official patch becomes available.

The CVSS score is 5.6, indicating a moderate severity. The EPSS score is less than 1%, suggesting that the likelihood of exploitation in the near term is low. The vulnerability is not listed in the CISA KEV catalog, further supporting a lower risk posture. The attack can be performed by a user who can trigger the local data modification flow, typically through the application’s user interface, implying that the primary vector is a local or user-initiated interaction.