This vulnerability (CWE-862) arises from missing authorization checks in the SAP S/4HANA OData Service component responsible for managing reference equipment. An attacker with some level of privileges (PR:L) can perform unauthorized update and delete operations on child entities through the OData interface. The vulnerability does not compromise confidentiality or availability but poses a significant risk to data integrity within the affected SAP system. The CVSS vector indicates network attack vector, low attack complexity, no user interaction required, and unchanged scope.

The primary impact is on the integrity of data managed by the SAP S/4HANA OData Service (Manage Reference Equipment). Unauthorized modifications or deletions of child entities could lead to corrupted or inconsistent data states. Confidentiality and availability are not affected according to the provided information. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, organizations should monitor SAP security advisories for updates. Until a fix is available, restrict access to the affected OData service to trusted users only and review existing authorization configurations to minimize exposure.