Home

Description

setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content

PUBLISHED Reserved 2026-05-07 | Published 2026-07-14 | Updated 2026-07-14 | Assigner sap




MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation

Product status

Default status
unaffected

@ui5/webcomponents-base < 2.21.0
affected

References

github.com/...onents/security/advisories/GHSA-p8gx-753q-v89p

url.sap/sapsecuritypatchday

cve.org (CVE-2026-44767)

nvd.nist.gov (CVE-2026-44767)

Download JSON