Vulnerability · Published Sep 8, 2026 · Assigned by sap
CVE-2026-76969Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
Critical 9.4
In plain English
A critical-severity security flaw in SAP Cloud Application Programming Model (CAP) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @sap/cds-mtxs | 4.0.3 | GHSA-955m-rr6m-2f9v |
| npm | @sap/cds-mtxs | 3.9.7 | GHSA-955m-rr6m-2f9v |
| npm | @sap/cds-mtxs | 2.7.7 | GHSA-955m-rr6m-2f9v |
| npm | @sap/cds-mtxs | 1.18.4 | GHSA-955m-rr6m-2f9v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Cloud Application Programming Model (CAP) | @sap/cds-mtxs <=1.18.3<=2.7.6<=3.9.6<=4.0.2 |
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H