This vulnerability arises from missing authorization checks in the SAP S/4HANA backend OData Service responsible for managing reference structures. An attacker with at least some level of privileges (PR:L) can remotely update or delete child entities exposed via the OData service without proper authorization validation. The vulnerability affects the integrity of data but does not compromise confidentiality or availability. The CVSS 3.1 base score is 6.5, reflecting a medium severity level. The affected version is S4CORE 109. No patch or official remediation level has been published by SAP as of the current data.

The primary impact is on data integrity, as unauthorized modification or deletion of child entities can occur. Confidentiality and availability are not impacted by this vulnerability. There are no known exploits in the wild, reducing immediate risk, but the potential for unauthorized data manipulation remains until addressed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor SAP advisories closely. Until a patch is available, restrict access to the affected OData services to trusted users only and apply the principle of least privilege to minimize potential exploitation.