CVE-2026-44767 Details
Description
setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content
A vulnerability exists in SAP UI5 Web Components due to the setThemeRoot() function not properly enforcing the sap-allowed-theme-origins allowlist. This flaw allows an attacker to store and use an absolute cross-origin URL to inject arbitrary CSS into a victim's page. The exploitation can be achieved through an attacker-influenced input, such as a URL query parameter or tenant configuration. The injected CSS could be used for various malicious purposes, including UI redressing, clickjacking, phishing overlays, visual defacement, and limited data exfiltration via CSS attribute selectors targeting predictable DOM content.
Users are advised to consult the SAP Security Notes and implement the recommended patches. For guidance on accessing SAP Security Notes, visit the SAP Security Notes FAQs.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p | [email protected] | |
| https://url.sap/sapsecuritypatchday | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | New CVE Received | [email protected] |