A missing authorization check in the SAP Business Warehouse (Service API) allows an authenticated attacker to invoke an affected RFC function module and execute unauthorized actions. This flaw can be used to alter configuration settings, disrupt request processing, and ultimately cause a denial of service, impacting service availability while leaving integrity low and confidentiality unchanged. The weakness corresponds to CWE‑862, an improper authorization bypass.

The vulnerability targets SAP Business Warehouse (Service API) from SAP SE. No specific version information is disclosed, so all installations of the Service API that may use the exposed RFC function module should be considered potentially affected until further vendor guidance is received.

The CVSS score is 5.9, indicating moderate severity. EPSS shows a probability of exploitation of less than 1%, suggesting a very low likelihood of attack, and the flaw is not listed in the CISA KEV catalog. The attack vector is authenticated, meaning the attacker must already have valid credentials to access the system. Successful exploitation would result in denial of service through erroneous configuration changes.