CVE-2026-44767
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The setThemeRoot() function fails to enforce the sap-allowed-theme-origins allowlist. An attacker can store and use a controlled absolute cross-origin URL to construct a <link rel=stylesheet> element, even without the <meta name=sap-allowed-theme-origins> tag. The bypass is also reachable via the ?sap-themeRoot URL parameter.
Risk Assessment
The organization is at risk of arbitrary CSS injection into the victim's page, enabling UI redressing, clickjacking, phishing overlays, visual defacement, and limited data exfiltration via CSS attribute selectors.
Recommendation
Immediately update the SAPUI5 library to a version that fixes the setThemeRoot() function and remove or secure the ?sap-themeRoot parameter in the application configuration.
Other vulnerabilities in SAPUI5
See all- CVE-2026-66771Medium
SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session.
- CVE-2026-34258Medium
In SAPUI5 (Search UI), an unauthenticated attacker can manipulate specific URL parameters in the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on integrity and availability.
Original NVD description (English source)
setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content
Vulnerability data from NVD (NIST) · CISA KEV · EPSS