CVE-2026-76977
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
Risk Assessment
The risk includes the possibility of tricking an authenticated user into performing unintended actions, which may compromise data or operational integrity.
Recommendation
Apply the SAP UI5 update that fixes the parent frame origin validation.
Other vulnerabilities in SAP UI5
Original NVD description (English source)
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS