The vulnerability is a missing authorization check in the Disconnected Operations component of SAP S/4HANA Defense & Security. An attacker who already has a standard user account can invoke remote-enabled function modules and perform direct updates to standard SAP database tables. This flaw allows modification of data, resulting in a low-impact integrity breach, with no effect on confidentiality or application availability.

Affected configurations are all SAP S/4HANA Defense & Security (Disconnected Operations) releases from version 600 through 809, covering the specific sub-releases 603, 604, 605, 606, 616, 617, 618, 619, 800, 801, 802, 803, 804, 805, 806, 807, 808, and 809. The vulnerability is present in every listed release until the highest enumerated version.

The CVSS base score of 4.3 classifies the vulnerability as low severity. The EPSS score is below 1%, indicating a very low probability of exploitation at the time of assessment. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires an authenticated user with at least standard privileges, so the attack vector is internal, and an attacker must be able to log on to the system and execute the privileged function modules.