SAP Manufacturing Integration and Intelligence (Configuration Service) lacks an authorization boundary in its administrative functions, allowing an attacker who already has MII administrator privileges to submit a specially crafted request that creates an account with elevated privileges on the underlying Java application server. Successful exploitation effectively delivers administrative control over the system, compromising confidentiality, integrity, and availability beyond the vulnerable application. The weakness is classified as CWE-862: Authorization Bypass Through User-Controlled Key.

The vulnerability affects SAP Manufacturing Integration and Intelligence (Configuration Service). Specific version information is not provided in the available data.

The CVSS score of 9.1 signifies a high severity of the flaw. The EPSS score is not available, indicating insufficient data about exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to possess MII administrator privileges, after which the flaw can be triggered to elevate privileges on the Java application server and gain full administrative control.