Cross-Origin Bypass in SAP Software Components

CVE-2026-44767

What is CVE-2026-44767?

A vulnerability exists in SAP Software Components where the setThemeRoot() function fails to enforce the sap-allowed-theme-origins allowlist. This issue allows an attacker to store and utilize a malicious absolute cross-origin URL to construct a element, regardless of the absence of the tag. Attackers can exploit this weakness through manipulated input, such as URL query parameters or user settings, leading to the injection of arbitrary CSS into the victim's page. Successful exploitation can result in UI redressing, clickjacking, phishing overlays, visual defacement, and potential data exfiltration via CSS attribute selectors targeting predictable DOM content.

References