Description

SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-11T01:17:21.923Z",
  "pubdate": "2026-08-11T01:17:21.923Z",
  "executiveSummary": "This vulnerability involves insufficient validation of tenant context within inbound HTTP requests processed by the SAP Approuter. The flaw permits an unauthenticated threat actor to dispatch specially crafted requests capable of spoofing the intended tenant context under specific operational conditions that are not fully controlled by the attacker.\nSuccessful exploitation of this security deficiency grants unauthorized, limited access to sensitive information belonging to a distinct, co-hosted tenant within the multi-tenant architecture. The resulting impact is strictly constrained to a low-level compromise of data confidentiality, with no associated degradation of system integrity or service availability.\nThe affected product is the SAP Approuter component. Risk implications include cross-tenant data exposure in shared environments. The required attacker capabilities involve the ability to formulate and transmit crafted inbound requests across the network, contingent upon specific conditions necessary to successfully spoof the target tenant context.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and context parsing mechanisms within the SAP Approuter component handling inbound HTTP requests. Specifically, the application fails to rigorously verify and bind the incoming tenant context headers or routing parameters to the verified authentication session of the request originator.\nThe vulnerable component is the routing and tenant resolution logic within the SAP Approuter. Network exposure is present wherever the SAP Approuter accepts external inbound connections for multi-tenant routing. Authentication requirements are non-existent for the initial request vector, as the vulnerability can be targeted by an unauthenticated attacker. Privilege requirements are similarly low, requiring no prior administrative or tenant-level access.\nThe exploitation method relies on the transmission of meticulously crafted inbound requests containing manipulated parameters or headers designed to deceive the tenant context resolution routines. The attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request where the tenant identification parameters are deliberately altered or injected. Second, the SAP Approuter receives this inbound request at the network boundary. Third, due to the insufficient validation logic, the Approuter misinterprets the spoofed tenant context and maps the request to an incorrect tenant boundary. Fourth, the request is processed within the scope of the unintended tenant.\nThe payload behavior involves forcing the routing layer to evaluate the session or resource request against a foreign tenant's context. Post-exploitation impact is limited to the retrieval or exposure of specific information belonging to the targeted second tenant, resulting in a low confidentiality impact. Integrity and availability remain completely unaffected, as the flaw does not facilitate data modification, execution of arbitrary code, or denial of service conditions."
}