Home

Description

SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.

PUBLISHED Reserved 2026-03-26 | Published 2026-05-12 | Updated 2026-05-12 | Assigner sap




MEDIUM: 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Problem types

CWE-451: User Interface Misrepresentation of Critical Information

Product status

Default status
unaffected

SAPUI5 1.108
affected

1.120
affected

1.136
affected

1.142
affected

1.71
affected

1.84
affected

1.96
affected

References

me.sap.com/notes/3726583

url.sap/sapsecuritypatchday

cve.org (CVE-2026-34258)

nvd.nist.gov (CVE-2026-34258)

Download JSON