The CVSS 5.9 rating for CVE-2026-58237 likely understates the actual risk in SAP environments, and the reason stems from a fundamental misunderstanding of what 'low privilege' signals in this context. This is not a missing authentication flaw — it is an authorization bypass. The distinction is critical: an authenticated user with valid credentials can exploit this vulnerability because the system functions normally for authentication purposes, but fails to enforce access restrictions that should apply to specific resources. In SAP Approuter, WebSocket endpoints appear to operate under different authorization assumptions than HTTP endpoints, creating a gap that security tools rarely monitor.
The WebSocket channel is the compounding factor. These persistent, full-duplex connections bypass standard SIEM correlations that rely on HTTP request patterns. An attacker using valid credentials can exfiltrate data through this channel slowly — below volume thresholds, without triggering anomaly detection — because the traffic looks legitimate throughout the interaction. SAP Approuter sits as the ingress control plane for business application ecosystems, not a single service. A low-privilege user in one business unit accessing data designed for another unit represents lateral movement that CVSS cannot capture because it evaluates components in isolation.
The 'limited modifications' vector deserves serious attention in SAP contexts. Even minor write capabilities — modifying a workflow parameter, altering a user preference that downstream systems trust — can manipulate business processes without touching core data. This is a pivot point toward operational impact that confidentiality-focused scoring encourages analysts to discount.
Your priorities: First, verify whether WebSocket endpoints in your SAP Approuter deployment enforce the same authorization constraints as HTTP routes — this requires examining the configuration, not just the patch. Second, enable WebSocket traffic logging if you have not already; the monitoring gap is structural, not incidental. Third, audit role assignments for users classified as 'low privilege' — in SAP environments, these accounts often have more access than documentation suggests due to complex role hierarchies that organizations struggle to audit. Finally, treat this as a boundary-component vulnerability: the impact is mediated by whatever data the routing layer touches, and that exposure may extend across business units or functions you did not intend to be accessible.