# CVE-2026-44767: SAP UI5 Web Components CSS injection in setThemeRoot

Source: https://junglewise.ai/threats/cve-2026-44767-sap-ui5-web-components-css-injection-in-setthemeroot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-44767 · Severity: medium · CVSS 6.1 · Published 2026-07-14

A vulnerability in SAP UI5 Web Components could allow an attacker to manipulate the visual appearance of a web application. By tricking a user into clicking a malicious link or visiting a compromised site, an attacker can inject custom styling to create fake login overlays, hide important information, or perform clickjacking attacks. This could lead to unauthorized data entry by users who believe they are interacting with a legitimate interface.

Vendors: [SAP SE](https://junglewise.ai/threats/vendors/sap-se).

## Quick answers

**Is CVE-2026-44767 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44767 being exploited in the wild.

**How severe is CVE-2026-44767?** Medium severity, with a CVSS score of 6.1, published 14 July 2026.

**Which products and versions are affected?** SAP SE @ui5/webcomponents-base < 2.21.0.

**Is there a fix for CVE-2026-44767?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44767 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44767?** Check whether you run SAP SE UI5 Web Components Base. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The setThemeRoot() function in @ui5/webcomponents-base fails to enforce the 'sap-allowed-theme-origins' allowlist, even when the corresponding meta tag is absent. This allows an attacker to provide an absolute cross-origin URL through the 'sap-themeRoot' URL parameter or other attacker-influenced inputs. The application then uses this URL to construct a <link rel=stylesheet> element, leading to arbitrary CSS injection. This can be leveraged for UI redressing, phishing overlays, and limited data exfiltration using CSS attribute selectors. The issue is fixed in version 2.21.0.

## Affected products

- SAP SE @ui5/webcomponents-base < 2.21.0

## Timeline

- 2026-07-14: advisory: NVD and SAP published the advisory.
- 2026-07-14: disclosed

## References

- [https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p](https://github.com/UI5/webcomponents/security/advisories/GHSA-p8gx-753q-v89p)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)