The SAP Incentive and Commission Management application contains an insufficient authorization check that lets an authenticated user invoke a remote‑enabled function module to perform table update operations. This flaw allows an attacker who has valid credentials to alter stored data, which results in a low‑impact loss of data integrity. The vulnerability does not affect confidentiality or availability of the application.

The affected product is SAP Incentive and Commission Management. No specific product versions are listed, so any deployed instance of this SAP solution that does not have the relevant security update may be susceptible.

The CVSS score of 4.3 labels this issue as low severity, and the EPSS score is not available while the vulnerability is not listed in CISA’s KEV catalog. The flaw requires an authenticated user to be able to reach the SAP system; it does not provide remote code execution or other elevated privileges. Consequently, the risk is limited to attackers who already possess valid credentials and can use the function module to modify data.