Vulnerability · Published Jul 14, 2026 · Assigned by sap
CVE-2026-44767Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection
Medium 6.1
In plain English
A medium-severity cross-site scripting in @ui5/webcomponents-base from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | @ui5/webcomponents-base | @ui5/webcomponents-base < 2.21.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N