EUVD-2026-55871
GHSA-w69g-xj7m-rmrv
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint, no auth needed, but uncontrollable exploitation conditions justify AC:H; only partial cross-tenant confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
AnalysisAI
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft requests that bypass tenant isolation, resulting in limited cross-tenant information disclosure. Exploitation is constrained by High Attack Complexity (AC:H per vendor CVSS), meaning conditions necessary for success are not fully under attacker control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network access to the SAP Approuter HTTP endpoint (AV:N); no authentication is required to send the crafted request (PR:N per vendor CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS base score of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) is low and reflects an accurate picture of constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the SAP Approuter node.js package to version 23.0.0 or later, as confirmed by vendor advisory SAP Security Note 3786038 and EUVD-2026-55871. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker t
Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged netwo
Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privilege
Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BT
Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-p
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privil
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attac
Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrad
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attack
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today