The vulnerability arises from a missing authorization check in the SAP S/4HANA backend OData Service for Manage Reference Structures. Because the service fails to validate user permissions, an attacker can modify or delete child entity records through exposed OData endpoints. This results in a breach of data integrity, allowing unauthorized changes to critical business data. The weakness corresponds to CWE‑862, Unauthorized Access.

SAP S/4HANA Backend OData Service (Manage Reference Structures) is the impacted product. The CVE specifically references SAP SE’s implementation of this service on the SAP S/4HANA platform. No specific version numbers are supplied, so all deployments of this component may be affected until a fix is applied.

The CVSS score for this issue is 6.5, indicating a moderately high potential for harm. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed as a known exploited vulnerability by CISA. An attacker would need network access to the SAP S/4HANA system and appropriate credentials that grant access to the OData interface; once the request is sent, the missing check permits the update or deletion of data without further authorization.