A missing authorization check in SAP ERP and SAP S/4 HANA allows an authenticated attacker to execute a specific ABAP report that can overwrite any existing eight‑character executable ABAP report without the necessary authorization. The weakness is categorized as CWE‑862 (Missing Authorization). Once the overwritten report is run, its intended functionality can be lost, which results in a service disruption for the affected functionality. The integrity impact is restricted to the overwritten report, and no data confidentiality is compromised.

The vulnerability affects SAP’s ERP and SAP S/4 HANA systems, both in private cloud and on‑premise deployments. The CNA SAP SE has identified these products as impacted. Specific affected versions are not listed, so all running installations of these products could be at risk if they have not applied the available patch.

The CVSS base score of 7.1 indicates a medium severity level. EPSS data is unavailable and the vulnerability is not included in CISA’s KEV catalog, suggesting no publicly known exploits at this time. The primary attack vector is inferred to be an authenticated user in the SAP environment, as the missing authorization check only protects against users who appear to be authorized. Exploitation requires that the attacker possess valid credentials and sufficient rights to execute the vulnerable ABAP report. The impact after exploitation is limited to the availability of the overwritten report and its constituent functionality.