A missing authorization check in SAP Business Analytics and SAP Content Management allows an authenticated user to invoke remote function modules that the user is not authorized to call. This flaw is a classic example of CWE‑862: Authorization Bypass Through User‑Controlled Key. The result is that sensitive data may be exposed, thereby compromising confidentiality while leaving integrity and availability unaffected.

The vulnerability applies to SAP Business Analytics and SAP Content Management. No specific product versions are listed, so all deployments of these services should validate their build against SAP Note 3705094 to determine exposure.

The CVSS score of 6.5 indicates medium severity. EPSS information is unavailable and the issue is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated session; the attacker must already possess a user account with valid credentials. The lack of an unauthenticated attack surface limits the exploitation likelihood, but the potential for confidential data leakage makes the overall risk moderate to high if left unmitigated.