This vulnerability arises from missing authorization checks in the SAP S/4HANA OData Service responsible for managing technical object structures. An attacker with at least some privileges (PR:L) can perform unauthorized update and delete operations on child entities exposed through the OData service. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no user interaction required, and impact limited to integrity. Confidentiality and availability are unaffected. The affected version is S4CORE 109. No vendor advisory or patch information is currently available.

The vulnerability allows unauthorized modification and deletion of child entities within the affected SAP OData service, resulting in a low impact on data integrity. Confidentiality and availability remain unaffected. This could lead to unauthorized data changes within the technical object structures managed by the service, potentially affecting business processes relying on this data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected OData service to trusted users only and monitor for unusual modification activities. Avoid exposing the vulnerable service to untrusted networks or users with limited privileges that could exploit this missing authorization check.