CVE-2026-66777

{
  "id": "CVE-2026-66777",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T01:17:24.160",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability."
    },
    {
      "lang": "es",
      "value": "SAP Approuter no valida suficientemente ciertas solicitudes entrantes antes de reenviarlas a destinos de backend. Debido a la complejidad de las condiciones requeridas, un atacante con privilegios bajos podría enviar solicitudes especialmente diseñadas para eludir las comprobaciones de autorización y alcanzar recursos protegidos más allá de su alcance asignado. La explotación exitosa podría permitir al atacante leer datos sensibles y realizar modificaciones limitadas en recursos protegidos, resultando en un alto impacto en la confidencialidad y un bajo impacto en la integridad. No hay impacto en la disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Business AI Platform (Approuter)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "SAP Approuter node.js package < 23.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T13:16:23.567451Z",
          "id": "CVE-2026-66777",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "23.0.0",
              "matchCriteriaId": "BC1312BC-17DB-45F4-864B-606D46FFFDEE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3786038",
      "source": "[email protected]",
      "tags": [
        "Permissions Required"
      ]
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}