CVE-2026-44767

setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content

• CWE-79

• https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p
• https://url.sap/sapsecuritypatchday

Published

Jul 14, 2026

Last Modified

Jul 14, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44760Due to a Cross-Site Scripting (XSS) vulnerability, applicati…4.7
• CVE-2026-44761SAP Commerce Cloud could retain a sample OAuth2 client with …9.1
• CVE-2026-44762SAP Data Services Management Console allows an overly permis…3.7
• CVE-2026-44763SAP Manufacturing Integration and Intelligence allows a priv…7.6
• CVE-2026-44764Due to a Missing Authorization Check vulnerability in SAP Ma…7.3
• CVE-2026-44765Due to a Missing Authorization Check vulnerability in SAP Ma…7.3
• CVE-2026-44768SAP CRM WebClient UI allows an attacker to inject and execut…4.1
• CVE-2026-44769SAP S/4HANA application Project Management (PPM-PRO) allows …5.5
• CVE-2026-4477A vulnerability was determined in Yi Technology YI Home Came…3.1
• CVE-2026-44770SAP Create Single Payment does not perform necessary authori…4.3
• CVE-2026-44771SAP S/4HANA Draft operation does not perform necessary autho…4.3
• CVE-2026-44774Traefik is an HTTP reverse proxy and load balancer. Prior to…9.9