A missing authorization check within the SAP S/4HANA OData Service that manages reference equipment allows an attacker who can reach the service to update or delete child entities without proper approval. This directly undermines the integrity of operational data, potentially leading to incorrect asset records or configuration information. The vulnerability does not expose sensitive information and does not disrupt service availability.

The flaw affects SAP S/4HANA installations that expose the OData Service for managing reference equipment. The advisory does not list specific version numbers, so any instance containing this service should be examined for the missing check. The affected component is part of the standard SAP Enterprise Resource Planning suite.

The CVSS base score of 6.5 indicates moderate severity with high impact on data integrity. The EPSS score is not available, and there is no record of exploitation in publicly known campaigns. The likely attack vector is remote via the exposed OData endpoint over the network, and the attacker needs to send crafted requests that bypass authorization. Because the check is omitted, the attack can be automated once access to the endpoint is achieved, presenting a substantial risk to the underlying data.