SAP ERP (HCM Travel Management) versions - 600 602 603 604 605 606 607 608 allows an authenticated but unauthorized attacker to read modify and settle trips resulting in escalation of privileges due to Missing Authorization Check.