During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages that can be intercepted by an authenticated user with low privileges. An attacker can guess and enumerate these messages to learn content beyond their authorized scope, leading to disclosure of sensitive information. The vulnerability does not affect integrity or availability, but the loss of confidentiality can severely impact stakeholder trust and regulatory compliance.

The vulnerability impacts SAP Human Capital Management for SAP S/4HANA. No specific product versions are listed, so any instance of this SAP module that has not applied the latest fixes may be affected. Users should verify the presence of SAP Note 3680767 or subsequent security patches.

The CVSS base score of 6.5 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack requires an authenticated SAP account with low privileges; the attacker must manually trigger the authorization checks and parse the returned messages, which indicates a moderate level of skill and access. While there are no publicly disclosed exploits, organizations should treat this as a medium risk and prioritize remediation.