EUVD-2026-55889
GHSA-94ww-hmrp-6w4f
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-exploitable proxy bypass requires authenticated low-privilege account and vendor-confirmed complex path conditions (AC:H/PR:L); no availability impact per description.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
AnalysisAI
Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privileged authenticated attacker to send specially crafted requests that escape the Approuter's routing authorization controls and reach protected backend destinations beyond their assigned scope. Successful exploitation yields high confidentiality impact - exposure of sensitive backend data - and limited integrity impact through restricted modifications to protected resources, with no effect on availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold low-privilege authenticated access to the SAP BTP tenant or application hosting the Approuter instance, as confirmed by PR:L in the CVSS vector - unauthenticated external actors cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.9 (Medium) is shaped primarily by AC:H, which SAP explicitly attributes to the complexity of conditions required - this substantially reduces the practicality of opportunistic or automated exploitation despite the network attack vector (AV:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the SAP Approuter Node.js package to version 23.0.0 or later, which is the vendor-released fix per SAP Note 3786038 (https://me.sap.com/notes/3786038) and the SAP Security Patch Day advisory (https://url.sap/sapsecuritypatchday). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker t
Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged netwo
Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BT
Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-p
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privil
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attac
Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrad
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attack
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft req
Same weakness CWE-22 – Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today