Display Product Catalog Based on Customs Declaration does not enforce sufficient authorization checks within certain functionality, allowing an authenticated low‑privileged user to view sensitive information beyond their intended authorization scope. The vulnerability results in a low‑confidentiality impact, with no discernible effect on the application’s integrity or availability. This flaw is a classic example of improper authorization (CWE‑863).

SAP Global Trade Services, edition for SAP HANA – specifically the Display Product Catalog Based on Customs Declaration component. No version constraints are listed, so all current releases of this product are potentially affected until a patch is applied.

The CVSS score of 4.3 classifies the flaw as low severity, and the EPSS is not available, indicating limited known exploitation data. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require a legitimate or compromised authenticated session with low privileges; it is therefore likely an internal attack vector that could occur in environments where credential compromise or user mis‑assignment is possible. No public exploits are documented, but the exposed data could provide an attacker with useful information for further compromise.