The vulnerability allows an authenticated SAP S/4HANA user to read restricted payment media information that should otherwise be protected. This results in a small confidentiality disclosure to the attacker, with no impact on data integrity or availability. The weakness is categorized as CWE-497, reflecting improper authorization control.

SAP S/4HANA (Manage Payment Media) versions 600 through 902, as well as SAP S/4HANA UI for SAP HANA 109, are affected according to the Common Platform Enumeration entries. Only installations running these specific release levels without the vendor patch are vulnerable.

The CVSS score of 4.3 indicates low overall risk, and the EPSS score of less than 1% suggests that exploitation attempts are very unlikely at present. Because the vulnerability requires a valid authenticated session, an attacker would need to compromise or obtain credentials for a legitimate user. The vulnerability is not listed in the CISA KEV catalog, further indicating lower threat priority, but patching remains recommended.