Description

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-11T01:17:21.677Z",
  "pubdate": "2026-08-11T01:17:21.677Z",
  "executiveSummary": "An insufficient authorization vulnerability has been identified within the WebSocket implementation of SAP Approuter. This security flaw enables authenticated attackers possessing low privileges to interact with restricted functionality that should otherwise be inaccessible under standard access control policies.\nSuccessful exploitation of this vulnerability has a high impact on data confidentiality and a low impact on system integrity, while maintaining no adverse effect on service availability. The vulnerability exposes sensitive information to unauthorized actors and permits limited unauthorized modifications to be executed within the affected application context.\nThe affected product is SAP Approuter, specifically involving its WebSocket handling mechanisms. The risk implication is significant due to the potential breach of confidentiality boundaries within multi-tenant or role-segmented enterprise environments.\nExploitation requirements dictate that the attacker must possess low-level privileges within the system to establish the initial WebSocket connection and interact with the vulnerable endpoints. No complex execution vectors or high-level administrative credentials are required to initiate the unauthorized access flows.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate or missing authorization checks within the WebSocket processing functionality of SAP Approuter. When clients upgrade HTTP connections to WebSocket protocols or transmit messages over established WebSocket channels, the application fails to adequately validate whether the authenticated user context possesses the necessary privileges to execute specific commands or access designated data streams.\nThe vulnerable component resides in the WebSocket handling module of SAP Approuter. Network exposure includes any environment where SAP Approuter exposes WebSocket interfaces to clients, requiring the attacker to have network connectivity to the application router and a valid low-privilege user session to authenticate the initial connection.\nThe attack flow proceeds as follows: First, an attacker with low privileges establishes a standard WebSocket connection to the SAP Approuter instance using valid credentials. Second, rather than disconnecting or terminating the handshake, the client sends specific WebSocket frames targeting restricted functionality or internal command channels that lack proper access control validation. Third, because the underlying backend logic fails to enforce authorization boundaries for these specific WebSocket interactions, the server processes the request and returns restricted data or executes the requested limited modifications.\nPost-exploitation impact includes the unauthorized retrieval of sensitive information accessible via the vulnerable WebSocket functions, as well as the execution of limited unauthorized modifications to application states or data schemas. The lack of integrity impact indicates that modifications are constrained to specific low-impact parameters, and the absence of availability impact ensures that denial-of-service conditions are not triggered through this vector."
}