CVE-2026-66777

SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3786038	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Approuter no valida suficientemente ciertas solicitudes entrantes antes de reenviarlas a destinos de backend. Debido a la complejidad de las condiciones requeridas, un atacante con privilegios bajos podría enviar solicitudes especialmente diseñadas para eludir las comprobaciones de autorización y alcanzar recursos protegidos más allá de su alcance asignado. La explotación exitosa podría permitir al atacante leer datos sensibles y realizar modificaciones limitadas en recursos protegidos, resultando en un alto impacto en la confidencialidad y un bajo impacto en la integridad. No hay impacto en la disponibilidad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66777

Mitre link : CVE-2026-66777

CVE.ORG link : CVE-2026-66777

JSON object : View

Products Affected

sap

approuter

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-66777", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66777", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:16:23.567451Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Business AI Platform (Approuter)", "versions": [{"status": "affected", "version": "SAP Approuter node.js package < 23.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:24.160", "references": [{"url": "https://me.sap.com/notes/3786038", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability."}, {"lang": "es", "value": "SAP Approuter no valida suficientemente ciertas solicitudes entrantes antes de reenviarlas a destinos de backend. Debido a la complejidad de las condiciones requeridas, un atacante con privilegios bajos podr\u00eda enviar solicitudes especialmente dise\u00f1adas para eludir las comprobaciones de autorizaci\u00f3n y alcanzar recursos protegidos m\u00e1s all\u00e1 de su alcance asignado. La explotaci\u00f3n exitosa podr\u00eda permitir al atacante leer datos sensibles y realizar modificaciones limitadas en recursos protegidos, resultando en un alto impacto en la confidencialidad y un bajo impacto en la integridad. No hay impacto en la disponibilidad."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:approuter:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BC1312BC-17DB-45F4-864B-606D46FFFDEE", "versionEndExcluding": "23.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}