A missing authorization check in the SAP S/4HANA OData Service for managing technical object structures allows an attacker to update or delete child entities through exposed OData endpoints. The flaw leads to unauthorized modification of data, resulting in a low-level impact on data integrity, while confidentiality and availability remain unaffected. The weakness is a classic missing authorization control (CWE‑862).

The affected system is SAP S/4HANA, specifically the OData Service for managing technical object structures. No specific software version details are provided in the report.

The CVSS score of 4.3 indicates a low severity overall, and no EPSS score is available, so the exploitation likelihood is uncertain. Because the vulnerability requires only access to the exposed OData endpoints, an attacker could exploit it from any network segment that can reach those services, assuming no authentication checks are in place. Although the impact on confidentiality and availability is minimal, the ability to alter or delete data could disrupt business processes, warranting prompt attention. The vulnerability is not listed in the CISA KEV catalog, but it still poses an integrity risk that should be mitigated.