CVE-2026-76969— Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
Quick assessment
Affected
SAP_SE SAP Cloud Application Programming Model (CAP)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NPM 库在处理启用了扩展性的多租户 CAP 应用程序中使用的某些功能时，未执行充分的检查。未认证的攻击者可以发送精心构造的请求，获取敏感凭据，并利用这些凭据替换或删除租户数据。成功利用该漏洞可能会对应用程序的可用性和完整性产生高影响，并可能部分影响业务数据的机密性。
Possible ATT&CK Techniques 3 AI
T1535 · Unused/Unsupported Cloud Regions T1210 · Exploitation of Remote Services T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76969
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
Source: CVE Program / CVE List V5
Vulnerability Description
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Cloud Application Programming Model (CAP) | @sap/cds-mtxs <=1.18.3 | - |
|
II. Public POCs for CVE-2026-76969
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76969
请登录查看更多情报信息。
Vendor Pages for CVE-2026-76969 (1)
Same Patch Batch · SAP_SE · 2026-09-08 · 17 CVEs total
| CVE-2026-44756 | 10.0 CRITICAL | Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing |
| CVE-2026-58240 | 9.8 CRITICAL | Missing Authentication check in SAP NetWeaver (Message Server) |
| CVE-2026-66768 | 9.0 CRITICAL | Improper Access Control in SAP NetWeaver (SAP GUI for Java) |
| CVE-2026-76958 | 8.5 HIGH | XML External Entity (XXE) Vulnerability in SAP Integration Suite |
| CVE-2026-76967 | 7.8 HIGH | Insecure Deserialization in SAP NetWeaver Business Client |
| CVE-2026-66767 | 7.7 HIGH | Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Plat |
| CVE-2026-76971 | 6.5 MEDIUM | Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence |
| CVE-2026-76968 | 6.5 MEDIUM | Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager |
| CVE-2026-44766 | 6.5 MEDIUM | SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) |
| CVE-2026-76959 | 4.6 MEDIUM | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payme |
| CVE-2026-76977 | 4.3 MEDIUM | Clickjacking vulnerability in SAPUI5(Frame Options Allowlist) |
| CVE-2026-76963 | 4.3 MEDIUM | Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform |
| CVE-2026-76962 | 4.3 MEDIUM | Missing Authorization check in SAP S/4HANA (Manage Bank Chains app) |
| CVE-2026-76961 | 3.5 LOW | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payme |
| CVE-2026-76960 | 3.5 LOW | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payme |
| CVE-2026-58234 | 2.2 LOW | Denial of Service vulnerability in SAP Process Integration (SOAP Adapter) |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher, -
CVE-2026-76967
Insecure Deserialization in SAP NetWeaver Business Client -
CVE-2026-76963
Missing Authorization Check in Application Server ABAP of SA
Same weakness: CWE-522
-
CVE-2026-86175
NetBox through 4.7.0 Credential Disclosure via REST and Grap -
CVE-2026-85700
Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool End -
CVE-2026-8862
Vulnerabilities exists in IBM Netezza Software -
CVE-2026-75136
UpSignOn < 7.19.0 Biometric Key Exposure via Windows Passwor -
CVE-2026-55856
MariaDB Connector/J: Cleartext password disclosure to a MITM
V. Comments for CVE-2026-76969
No comments yet