This vulnerability in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard) arises from a missing authorization check (CWE-862). An authenticated user with limited privileges can access information beyond their authorization and alter default settings and value fields. These changes can distort risk evaluations by lowering assessed risk levels inaccurately. The affected versions include SEM-BW 605, 700, 736, 746, 747, 748, 749, and 800. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity with no impact on availability. No known exploits in the wild or vendor patches are currently documented.

The vulnerability allows unauthorized access to sensitive information and unauthorized modification of configuration settings that influence risk evaluations. This can lead to misleading risk assessments by lowering risk levels inaccurately, impacting the confidentiality and integrity of data to a low extent. There is no impact on the availability of the application. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level has been provided by SAP, organizations should monitor SAP advisories for updates. Until a fix is available, restrict access to the affected SAP Strategic Enterprise Management Balanced Scorecard Wizard to trusted users only and review user privileges to minimize exposure.