EUVD-2026-72586
GHSA-955m-rr6m-2f9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach multitenant CAP extensibility endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitRetrieve tenant credentials (CWE-522)
-
ExecutionAuthenticate to tenant data store
-
ImpactReplace or delete tenant data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Exploitation requires the target to be a multitenant CAP application built on @sap/cds-mtxs with the extensibility feature enabled - the description explicitly scopes the flaw to 'multitenant CAP applications with extensibility enabled,' so a single-tenant deployment or one without extensibility is not affected. Given AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special client-side conditions are needed against a qualifying deployment; the attacker only needs network reachability to the vulnerable MTXS/extensibility endpoints. The limiting factor is therefore the deployment mode (multitenant + extensibility), not the attacker's privilege level. |
| Impact | This is a genuine high priority for anyone running multitenant CAP apps with extensibility enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H = 9.4) indicates fully remote, low-complexity, unauthenticated exploitation with no user interaction - a strong exploitation profile - and the impact skews toward integrity and availability (tenant data replacement/deletion) rather than confidentiality, which is only partial (C:L). Note the tag 'Information Disclosure' understates the real risk: while credentials are disclosed as an intermediate step, the confirmed outcome is destructive I:H/A:H, not a read-only leak. No EPSS score, KEV listing, or POC was provided; absence of these is not evidence of safety given the low attack complexity and SAP's own high rating. The main mitigating factor is deployment-specific: only multitenant CAP applications with extensibility enabled are exposed, which limits the affected population versus a blanket 'all CAP apps' reading. |
| Exploit ScenarioDerived | An attacker who can reach a multitenant CAP application's MTXS/extensibility endpoints over the network sends crafted, unauthenticated requests that trick the service into returning tenant credentials. Using those credentials, the attacker connects to the tenant's data store and overwrites or deletes business data, causing integrity loss and outages for affected tenants. No public exploit code was identified at time of analysis, but the low attack complexity makes reliable exploitation plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis.
RemediationAI
Apply the fix described in SAP Note 3798315 (https://me.sap.com/notes/3798315) and cross-referenced on SAP Security Patch Day (https://url.sap/sapsecuritypatchday) - upgrade @sap/cds-mtxs to the patched version SAP specifies (exact fixed version not included in the provided data; retrieve it from the SAP Note, which requires an S-user login). As a compensating control until patched, disable or restrict the extensibility feature in multitenant CAP deployments where it is not required, since the vulnerability is scoped to extensibility-enabled tenants - the trade-off is loss of tenant-specific extension capabilities. Additionally, place the tenant provisioning/MTXS endpoints behind authenticated gateway/network controls so unauthenticated requests cannot reach them, and rotate any tenant/service credentials that may have been exposed. Because the SAP references are authentication-gated, confirm the patched version against your SAP support portal rather than relying on version numbers from third parties.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SAP CAP is an enterprise framework for building service-oriented business applications on Node.js (and Java); @sap/cds-mtxs provides its multitenancy, extensibility, and toolkit services (per-tenant onboarding, schema/data isolation, and tenant-specific extensions). The CPE cpe:2.3:a:sap_se:sap_cloud_application_programming_model_(cap) identifies the affected SAP SE product. The root cause is CWE-522 (Insufficiently Protected Credentials): a code path exposed by the MTXS extensibility functionality does not adequately guard credentials, allowing an unauthenticated caller to retrieve secrets that were meant to be internal to tenant provisioning. Because those credentials grant access to tenant storage, obtaining them collapses the multitenant isolation model and permits destructive data operations across tenant data.
Know when Sap Cloud Application Programming Model Cap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Unauthenticated remote request against extensibility-enabled tenants (AV:N/AC:L/PR:N/UI:N); credential leak gives partial confidentiality (C:L) while data replace/delete yields I:H/A:H.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
DescriptionCVE.org
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.
Articles & Coverage 2
Executive ViewAI
The @sap/cds-mtxs library (SAP Cloud Application Programming Model extensibility component) contains an unauthenticated credential exposure vulnerability affecting multitenant CAP applications. Remote attackers without credentials can harvest tenant authentication tokens and use them to delete or modify business data across affected tenants. Organizations deploying SAP CAP with extensibility enabled face direct risk to data confidentiality, integrity, and availability.
No vendor-released patch identified at time of analysis. Interim mitigations and compensating controls are available through SAP Note 3798315; consult this advisory for authorized workarounds. Monitor SAP's security advisories for formal patch releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB