What’s Vulnerable › Vulnerabilities

CVE-2026-44767: Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-79

Description

setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content

Affected products

• SAP_SE @ui5/webcomponents-base: @ui5/webcomponents-base < 2.21.0

References

• https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-44767 or the next vulnerability affects your stack