{"id":"EUVD-2026-55866","enisaUuid":"0887a83a-f1dc-3938-a739-ce83087b26dc","description":"SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.","datePublished":"Aug 11, 2026, 12:12:16 AM","dateUpdated":"Aug 11, 2026, 2:32:14 PM","baseScore":7.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","references":"https://me.sap.com/notes/3786038\nhttps://url.sap/sapsecuritypatchday\n","aliases":"CVE-2026-58230\nGHSA-vhh6-v828-x62f\n","assigner":"sap","epss":0.31,"enisaIdProduct":[{"id":"37a042bd-59e1-38bc-8f76-92aa0217a5c0","product":{"name":"SAP Business AI Platform (Approuter)","vendor":{"name":"SAP_SE"}},"product_version":"SAP Approuter node.js package \u003c 23.0.0"}],"enisaIdVendor":[{"id":"ab4c585b-565f-39fa-ba44-8fb2c83a453a","vendor":{"name":"SAP_SE"}}],"enisaIdVulnerability":[{"id":"a7769c56-5dd7-3076-ba93-2233eba260e5","vulnerability":{"id":"CVE-2026-58230","description":"SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.","datePublished":"Aug 11, 2026, 12:12:16 AM","dateUpdated":"Aug 11, 2026, 2:32:14 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","references":"https://me.sap.com/notes/3786038\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-55866\n","assigner":"sap","epss":0.31,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"230f1fa0-d239-35e8-bf18-c91c55006f51","product":{"name":"SAP Business AI Platform (Approuter)","vendor":{"name":"SAP_SE"}},"product_version":"SAP Approuter node.js package \u003c 23.0.0"}],"vulnerabilityVendor":[{"id":"67489781-b445-3ff6-ae32-099c59ba66b5","vendor":{"name":"SAP_SE"}}]}},{"id":"f50d38e9-12a7-3b1f-baf4-31e001e15fcd","vulnerability":{"id":"GHSA-vhh6-v828-x62f","description":"SAP Approuter has an Information Disclosure vulnerability","datePublished":"Aug 11, 2026, 3:31:56 AM","dateUpdated":"Sep 1, 2026, 9:20:40 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-58230\nhttps://me.sap.com/notes/3786038\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-55866\n","aliases":"CVE-2026-58230\nGHSA-vhh6-v828-x62f\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"b689fca7-e607-3f64-9331-07047919c985","advisory":{"id":"WID-SEC-W-2026-2746","description":"SAP Patch Day August 2026: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen oder Anmeldedaten offenzulegen, Daten zu manipulieren, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial-of-Service-Zustand herbeizuführen.","datePublished":"Aug 10, 2026, 10:00:00 PM","dateUpdated":"Aug 16, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2746.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-2746\n","aliases":"CVE-2026-34265\nCVE-2026-40130\nCVE-2026-44758\nCVE-2026-44762\nCVE-2026-44763\nCVE-2026-44764\nCVE-2026-44765\nCVE-2026-58230\nCVE-2026-58231\nCVE-2026-58235\nCVE-2026-58236\nCVE-2026-58237\nCVE-2026-58238\nCVE-2026-58239\nCVE-2026-58241\nCVE-2026-58243\nCVE-2026-58244\nCVE-2026-58245\nCVE-2026-58247\nCVE-2026-58248\nCVE-2026-66760\nCVE-2026-66761\nCVE-2026-66763\nCVE-2026-66764\nCVE-2026-66770\nCVE-2026-66771\nCVE-2026-66772\nCVE-2026-66773\nCVE-2026-66774\nCVE-2026-66775\nCVE-2026-66776\nCVE-2026-66777\nCVE-2026-66778\nCVE-2026-66779\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"96afd68f-7c75-35b0-ac74-606f70490b5d","product":{"name":"SAP Software","vendor":{"name":"SAP"}}}]}}]}