The vulnerability CVE-2026-44753 in SAP HANA Extended Application Services classic model (User Self Service) allows unauthenticated users to send specially crafted requests that produce distinguishable responses. These response discrepancies enable attackers to enumerate valid user accounts and email addresses. The weakness is classified under CWE-204 (Observable Response Discrepancy). The CVSS v3.1 base score is 3.7, reflecting low impact on confidentiality and no impact on integrity or availability. No official remediation or patch information is provided, and no affected versions are specified.

Successful exploitation allows an attacker to enumerate valid user accounts and email addresses, which results in a low confidentiality impact. There is no impact on the integrity or availability of the application. This information disclosure could potentially aid further targeted attacks but does not directly compromise system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor SAP advisories for updates. Until a patch is available, consider restricting access to the affected user self service interfaces if possible or implementing additional monitoring for suspicious enumeration activity.