CVE-2025-23190

Vulnerability

Overview CVE-2025-23189 is a missing authorization check in a remote-enabled function module. The root cause is the failure to verify whether an authenticated user has the necessary permissions to invoke the function, leading to unauthorized data access.

Exploitation

An authenticated attacker can exploit this vulnerability by calling the remote-enabled function module without proper authorization. The attacker must have valid credentials but can access data beyond their intended scope. No special network position or additional privileges are required beyond authentication.

Impact

The impact is limited to unauthorized read access to data. The attacker cannot modify data or affect system availability, as stated in the CVE description [1]. The confidentiality impact is partial, with no integrity or availability impact.

Mitigation

SAP has released a security note as part of its regular Security Patch Day to address this vulnerability [1]. Users are advised to apply the latest patch or follow recommended workarounds provided by SAP.