Description

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-09-08T01:17:55.407Z",
  "pubdate": "2026-09-08T01:17:55.407Z",
  "executiveSummary": "The @sap/cds-mtxs library, utilized in SAP Cloud Application Programming (CAP) multitenant environments with extensibility features, contains a critical security vulnerability involving insufficient request validation.\nThis flaw allows unauthenticated remote attackers to bypass authorization controls, potentially leading to the acquisition of sensitive tenant credentials.\nBy leveraging these illicitly obtained credentials, an attacker can perform unauthorized operations, including the modification or deletion of tenant-specific data within the application.\nThe vulnerability poses a high risk to data integrity and service availability, with significant implications for the confidentiality of sensitive business information.\nExploitation requires no prior authentication, meaning an attacker can interact directly with the vulnerable endpoints to trigger the exploit.\nOrganizations relying on @sap/cds-mtxs for multitenancy must prioritize addressing this issue to prevent unauthorized data manipulation and potential service disruption.",
  "technicalDetails": "The vulnerability originates from a failure in @sap/cds-mtxs to implement sufficient request validation and authorization checks for specific functionality exposed in multitenant applications where extensibility is enabled.\nThe core issue involves the improper enforcement of security boundaries when processing requests, particularly those interacting with extensibility mechanisms that manage tenant-specific configurations or data contexts.\nBecause the validation logic is insufficient, the system fails to correctly verify the identity or authorization level of the requesting entity, allowing unauthenticated attackers to interact with internal API endpoints that should be restricted.\nThe attack flow begins with an unauthenticated actor crafting a specialized HTTP request targeting the vulnerable functionality within the @sap/cds-mtxs framework.\nUpon receiving this request, the library processes the input without adequate verification, inadvertently exposing sensitive information, such as tenant-specific credentials or internal security tokens, in the response or through secondary side-effects.\nOnce the attacker successfully retrieves these credentials, they can authenticate as a legitimate tenant or administrator, effectively bypassing standard security controls enforced at the application layer.\nWith these elevated privileges, the attacker gains the ability to execute unauthorized CRUD (Create, Read, Update, Delete) operations on tenant data.\nThe post-exploitation impact includes high impact on data integrity, as the attacker can perform arbitrary data deletion or manipulation, and a high impact on availability if critical tenant data is modified or purged to disrupt services.\nConfidentiality is also partially impacted, as the attacker may gain read access to business data that they are not authorized to access.\nThe vulnerability is inherent to the handling of extensibility features within the multitenant stack of the library and does not require complex preconditions other than the specific configuration of the application environment."
}