Script Injection Vulnerability in SAPUI5 by SAP

CVE-2026-66771

What is CVE-2026-66771?

SAPUI5 contains a vulnerability that permits key users with content adaptation privileges to inject malicious scripts into application changes. When these altered applications are accessed by other users, the scripts execute within their browser sessions. This exploitation could lead to unauthorized access to sensitive session data and allow attackers to perform actions impersonating the victims, severely impacting data confidentiality and integrity without affecting system availability.

References