The ODP Data Replication API’s Remote Function Call modules lack a check for caller identification, allowing any SAP‑internal or third‑party application to invoke the API without verification. This flaw can be used to retrieve data that the caller is not authorized to see, leading to potential disclosure of sensitive information. The vulnerability does not affect data integrity or cause significant availability problems, as the flaw is confined to the caller‑validation logic. CWE‑862 reflects missing authorization controls.

The affected product is SAP SE’s Operational Data Provisioning Data Replication API (ODP‑RFC). No specific affected versions are listed in the advisory, so all deployed instances may be vulnerable until a hot‑fix or patch is applied.

The CVSS score of 6.6 indicates moderate severity, focusing on confidentiality impact. Because EPSS is not available and the vulnerability is not listed in CISA KEV, the likelihood of exploitation is uncertain but potentially non‑negligible. The likely attack vector is remote via the RFC interface, which can be accessed by external applications that connect to the SAP system over network. An attacker would first need network access to the SAP gateways that expose the RFC endpoints and then craft calls that exploit the lack of caller verification to pull data.