EUVD-2026-43597
GHSA-5hp5-q35j-vjpg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
URL parameter delivery requires no privileges; victim page load is mandatory (UI:R); CSS injection crosses into victim page scope (S:C); no availability impact applies.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content
AnalysisAI
CSS stylesheet injection in SAP @ui5/webcomponents-base allows unauthenticated remote attackers to load arbitrary cross-origin stylesheets into victim pages by bypassing the sap-allowed-theme-origins allowlist enforcement inside setThemeRoot(). The ?sap-themeRoot URL query parameter is a direct delivery vector, making socially-engineered exploitation trivial - no authentication is required from the attacker (CVSS PR:N), only a victim page load (UI:R). Successful exploitation enables UI redressing, clickjacking, phishing overlays, visual defacement, and limited CSS attribute-selector-based data exfiltration; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The affected library, CPE cpe:2.3:a:sap_se:@ui5/webcomponents-base:*:*:*:*:*:*:*:*, is the foundational layer of SAP's UI5 Web Components framework, which underpins SAP Fiori applications, SAP Business Technology Platform (BTP) UIs, and custom enterprise frontends built on the @ui5/webcomponents ecosystem. The setThemeRoot() function dynamically loads theme CSS by constructing a <link rel=stylesheet> element targeting a caller-supplied root URL. A security mechanism - the sap-allowed-theme-origins meta tag allowlist - was intended to restrict which cross-origin URLs qualify as trusted theme sources, but the enforcement logic was either absent or bypassable: the function accepted absolute cross-origin URLs even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was independently reachable via the ?sap-themeRoot URL query parameter, which allows an attacker to influence setThemeRoot() without any server-side interaction. Browsers do not apply CORS restrictions to <link rel=stylesheet> loads (unlike XHR/fetch), making CSS injection via this vector a well-understood browser security boundary - the defence depends entirely on the application-layer allowlist that was not enforced. The assigned CWE-306 (Missing Authentication for Critical Function) is a debatable mapping; the root cause more precisely fits CWE-346 (Origin Validation Error) or CWE-184 (Incomplete List of Disallowed Inputs), which may affect automated risk-scoring tooling that relies on CWE classification.
RemediationAI
The primary fix is to apply the patched release of @ui5/webcomponents-base referenced in GitHub Security Advisory GHSA-p8gx-753q-v89p (https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p) and the SAP Security Patch Day advisory (https://url.sap/sapsecuritypatchday); upstream fix available (PR/commit), but the exact released patched version is not independently confirmed from available data - consult the advisories directly to identify the correct target version before updating. As an immediate compensating control, strip or reject the ?sap-themeRoot query parameter at the reverse proxy or WAF layer before requests reach the UI5 application, neutralising the most accessible delivery vector; this may break legitimate theme-switching workflows that rely on that parameter, so verify against business requirements before deploying. Deploy a strict Content Security Policy style-src directive limiting stylesheet loads to approved origins (e.g., your own SAP domain), which prevents the browser from loading attacker-hosted CSS even if the vulnerable code path executes - note this requires regression testing against existing SAP Fiori theme loading. Additionally, audit and validate any tenant configuration or user-supplied settings that invoke setThemeRoot() to enforce server-side allowlist checks against a fixed set of permitted theme origins as a defence-in-depth layer.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today