Description

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-11T01:17:23.407Z",
  "pubdate": "2026-08-11T01:17:23.407Z",
  "executiveSummary": "This vulnerability involves a stored cross-site scripting (XSS) security flaw within SAPUI5. The issue arises when an authenticated user with specific application privileges injects malicious script content into persisted application changes. When subsequent users open the adapted application, the injected payload executes automatically within the context of their active browser sessions.\nThe primary impact of successful exploitation includes a high compromise of confidentiality and integrity, allowing attackers to access sensitive session data and perform unauthorized actions on behalf of victim users. There is no direct impact on system availability.\nThe attack requires content adaptation privileges within the affected product to inject the malicious payload into persisted storage. Once stored, the attack vector affects any user who subsequently loads the compromised application adaptation layer, propagating the script execution without requiring further interaction from the secondary victims.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and output encoding within the SAPUI5 application adaptation mechanism. The system permits key users possessing content adaptation privileges to supply and persist arbitrary script content as part of application modifications.\nThe vulnerable component is the application change persistence mechanism of SAPUI5, which fails to properly neutralize executable script inputs before storing them in the application adaptation layers. Consequently, when another user loads the adapted application, the persistence layer retrieves the untrusted data and renders it directly into the Document Object Model (DOM) without adequate context-aware sanitization.\nPrivilege requirements include content adaptation capabilities within the application. Authentication is required to access the environment and submit the modified application changes. The attack vector manifests through persistent storage, allowing the injected payload to trigger across user sessions upon standard application access.\nThe step-by-step attack flow proceeds as follows: First, an attacker with content adaptation privileges crafts a malicious payload containing executable script content. Second, the attacker injects this payload into the persisted application changes feature provided by SAPUI5. Third, the application stores these unauthorized modifications within its persistence layer. Fourth, a victim user navigates to and opens the adapted application. Fifth, the application retrieves the stored changes, rendering the malicious script into the victim's DOM. Sixth, the script executes inside the victim browser session, inheriting their active session permissions, tokens, and access rights.\nPost-exploitation impact includes unauthorized execution of arbitrary actions within the victim's session, potential data exfiltration of sensitive application state data, and compromise of user session integrity."
}