SAPUI5 EUVD-2026-55883

The content adaptation feature (SAP Fiori key user adaptation / SAPUI5 Flexibility) must be enabled and accessible, which is a non-default administrative choice. The attacker must be authenticated with a key user account that has been explicitly granted content adaptation privileges - exploitation is impossible without this role assignment. A secondary victim user must actively open the adapted application after the malicious adaptation is persisted; exploitation does not occur passively or on the attacker's own session. Limiting factors: the required PR:H (high privilege) role is not assigned to ordinary end users; the feature must be deliberately enabled by administrators; and victims must interact with the specific adapted application version, not the baseline. These conditions meaningfully reduce the realistic attacker population compared to the raw CVSS score implies.

The CVSS 3.1 base score of 6.1 (Medium) is shaped by two important mitigating metrics: PR:H requires the attacker to already hold key user privileges with content adaptation rights, and UI:R requires a secondary victim to open the manipulated application. These two factors substantially limit exploitability compared to a typical stored XSS with no authentication requirement. However, the C:H and I:H impact ratings reflect the real damage once exploitation succeeds - full session compromise and the ability to perform any action the victim can perform. No EPSS score was provided in the source data, so exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified, suggesting opportunistic mass exploitation is not currently occurring. The realistic threat actor is a malicious or compromised insider who already holds the key user role - a relatively narrow but non-trivial threat model in large SAP deployments where key user rights are delegated broadly for business agility.

An insider threat actor holding a key user account with SAP Fiori content adaptation privileges navigates to the adaptation editor, injects a JavaScript payload (e.g., a cookie-harvesting script) into a persisted UI change for a widely used application such as a procurement or HR Fiori app. When a finance manager opens that application to approve invoices, the stored script silently executes in their browser, exfiltrates their SAP session token to an external endpoint, and submits unauthorized approval transactions on their behalf. No public proof-of-concept code has been identified, but the technique is well-understood and requires no specialized tooling beyond browser developer tools.