An SAP Solution Tools Plug‑In (ST‑PI) function module fails to perform required authorization checks for authenticated users, enabling disclosure of system information. The vulnerability results in a low‑impact confidentiality breach, with no effect on integrity or availability. This flaw maps to CWE‑862, reflecting a missing privilege check.

SAP Solution Tools Plug‑In (ST‑PI). No specific affected version information is provided in the CNA data.

Authenticated SAP users could invoke the vulnerable module and read system data. The embedded CVSS score of 5 indicates moderate overall risk, while an EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to be authenticated internal access, with no requirement for privilege escalation beyond legitimate user privileges.