PT-2026-57943 · Sap Se · @Ui5/Webcomponents-Base

Publicado 2026-07-14 · Atualizado 2026-07-14 · CVE-2026-44767

NVD

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-44767

Produtos afetados

@Ui5/Webcomponents-Base

Referências · 3

• https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p · Nota
• https://url.sap/sapsecuritypatchday · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-44767 · Nota de Segurança