EUVD-2026-55883
GHSA-v37p-2wmc-8vqg
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
PR:H reflects mandatory key user role; UI:R requires victim to open adapted app; S:U as XSS executes within the same application origin; A:N as availability is unaffected.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim, resulting in a high impact on confidentiality and integrity. There is no impact on availability.
AnalysisAI
Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
SAPUI5 is SAP's JavaScript-based UI framework underpinning SAP Fiori applications. The content adaptation feature - also called key user adaptation or SAPUI5 Flexibility - allows designated key users to persist UI modifications (layout changes, field additions, custom labels) that are then shared with all application users. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied content is not adequately sanitized before being stored and later rendered as part of the application's DOM. The stored payload survives between sessions and is served to every subsequent visitor of the adapted application. The CPE cpe:2.3:a:sap_se:sapui5:*:*:*:*:*:*:*:* confirms the vulnerability is within SAP SE's SAPUI5 product line itself, not a third-party plugin.
RemediationAI
Apply the patch documented in SAP Security Note 3772071 (https://me.sap.com/notes/3772071), released as part of SAP Security Patch Day. No specific fixed version number was provided in the available data - consult the SAP Note directly for the exact transport or package version applicable to each affected release track. As a compensating control pending patching, restrict the key user / content adaptation role assignment to the minimum necessary set of trusted users and audit existing assignments; this directly addresses the PR:H prerequisite and reduces the attacker surface. Additionally, reviewing and auditing currently persisted content adaptations across affected systems for unexpected script tags or event handlers can identify whether exploitation has already occurred. Disabling the content adaptation feature entirely is an option with significant functional trade-off - it removes all key user UI personalization capability - and should only be considered where the risk tolerance demands it.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today