CVE-2026-44767

{
  "id": "CVE-2026-44767",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T01:16:18.140",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content"
    },
    {
      "lang": "es",
      "value": "“setThemeRoot()” no pudo aplicar la lista de permitidos “sap-allowed-theme-origins”. Una URL absoluta de origen cruzado controlada por un atacante podría almacenarse y usarse directamente para construir un elemento “<link rel=stylesheet>”, incluso cuando no había ninguna etiqueta “<meta name=sap-allowed-theme-origins>” presente en el documento. El mismo bypass era accesible a través del parámetro de URL “?sap-themeRoot”. La explotación requiere una entrada influenciada por el atacante (p. ej., un parámetro de consulta de URL, una configuración de inquilino o una configuración proporcionada por el usuario) para llegar a “setThemeRoot()”. Un exploit exitoso permite a un atacante inyectar CSS arbitrario en la página de la víctima, lo que permite:\n- Revestimiento de UI y clickjacking\n- Superposiciones de phishing\n- Desfiguración visual\n- Exfiltración limitada de datos a través de selectores de atributos CSS dirigidos a contenido DOM predecible"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "@ui5/webcomponents-base",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "@ui5/webcomponents-base < 2.21.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T12:50:20.943832Z",
          "id": "CVE-2026-44767",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}