CVE-2026-66776

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3786038	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Approuter no aplica consistentemente la verificación de integridad en ciertos encabezados de solicitud relacionados con la sesión bajo condiciones específicas. Un atacante con privilegios bajos podría enviar una solicitud especialmente diseñada que omita la verificación de integridad y cargue el contexto de sesión de otro usuario. La explotación exitosa requiere que el atacante haya observado previamente valores de sesión coincidentes fuera de banda, lo que hace que el ataque sea complejo de ejecutar. Esto podría resultar en un alto impacto en la confidencialidad y un bajo impacto en la integridad. No hay impacto en la disponibilidad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66776

Mitre link : CVE-2026-66776

CVE.ORG link : CVE-2026-66776

JSON object : View

Products Affected

sap

approuter

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-66776", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66776", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:16:15.300819Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business AI Platform (Approuter)", "versions": [{"status": "affected", "version": "SAP Approuter node.js package < 23.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:24.030", "references": [{"url": "https://me.sap.com/notes/3786038", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability."}, {"lang": "es", "value": "SAP Approuter no aplica consistentemente la verificaci\u00f3n de integridad en ciertos encabezados de solicitud relacionados con la sesi\u00f3n bajo condiciones espec\u00edficas. Un atacante con privilegios bajos podr\u00eda enviar una solicitud especialmente dise\u00f1ada que omita la verificaci\u00f3n de integridad y cargue el contexto de sesi\u00f3n de otro usuario. La explotaci\u00f3n exitosa requiere que el atacante haya observado previamente valores de sesi\u00f3n coincidentes fuera de banda, lo que hace que el ataque sea complejo de ejecutar. Esto podr\u00eda resultar en un alto impacto en la confidencialidad y un bajo impacto en la integridad. No hay impacto en la disponibilidad."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BC1312BC-17DB-45F4-864B-606D46FFFDEE", "versionEndExcluding": "23.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}