Insufficient Origin Validation in SAP UI5 by SAP
CVE-2026-76977

4.3MEDIUM

Key Information:

Vendor

SAP
Status
SAPui5(frame Options Allowlist)
Vendor
CVE Published:
8 September 2026

What is CVE-2026-76977?

The vulnerability in SAP UI5 arises from inadequate validation of the parent frame's origin against the specified allowlist. This flaw allows unauthenticated attackers to host malicious web pages that can bypass established framing restrictions. If an authenticated user visits such a page and interacts with it, the attacker may deceive the user into executing unintended actions, ultimately leading to a compromise of the application's integrity. Although the vulnerability does not compromise confidentiality or availability, it is crucial for organizations using SAP UI5 to apply the latest security updates to mitigate this risk effectively.

Affected Version(s)

SAPUI5(Frame Options Allowlist) SAP_UI 750

SAPUI5(Frame Options Allowlist) 754

SAPUI5(Frame Options Allowlist) 755

References

https://me.sap.com/notes/3783189
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.