Executive brief
A vulnerability in SAP UI5 Web Components could allow an attacker to manipulate the visual appearance of a web application. By tricking a user into clicking a malicious link or visiting a compromised site, an attacker can inject custom styling to create fake login overlays, hide important information, or perform clickjacking attacks. This could lead to unauthorized data entry by users who believe they are interacting with a legitimate interface.
Technical details
The setThemeRoot() function in @ui5/webcomponents-base fails to enforce the 'sap-allowed-theme-origins' allowlist, even when the corresponding meta tag is absent. This allows an attacker to provide an absolute cross-origin URL through the 'sap-themeRoot' URL parameter or other attacker-influenced inputs. The application then uses this URL to construct a <link rel=stylesheet> element, leading to arbitrary CSS injection. This can be leveraged for UI redressing, phishing overlays, and limited data exfiltration using CSS attribute selectors. The issue is fixed in version 2.21.0.
Affected products
- SAP SE @ui5/webcomponents-base < 2.21.0
Timeline
- 2026-07-14: advisory: NVD and SAP published the advisory.
- 2026-07-14: disclosed