{"id":"EUVD-2026-55866","revision":"909efb18ab83421f9d40f87e329b422a","records":[{"revision":"909efb18ab83421f9d40f87e329b422a","observedAt":"2026-11-05T12:40:28.856+00:00","statement":{"source":"euvd","id":"EUVD-2026-55866","aliases":["CVE-2026-58230","GHSA-vhh6-v828-x62f"],"title":"SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled d…","description":"SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","score":7,"severity":null}],"references":["https://me.sap.com/notes/3786038","https://url.sap/sapsecuritypatchday"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55866","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 11, 2026, 12:12:16 AM","dateUpdated":"Aug 11, 2026, 2:32:14 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-2746","title":"SAP Patch Day August 2026: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-34265","CVE-2026-40130","CVE-2026-44758","CVE-2026-44762","CVE-2026-44763","CVE-2026-44764","CVE-2026-44765","CVE-2026-58230","CVE-2026-58231","CVE-2026-58235","CVE-2026-58236","CVE-2026-58237","CVE-2026-58238","CVE-2026-58239","CVE-2026-58241","CVE-2026-58243","CVE-2026-58244","CVE-2026-58245","CVE-2026-58247","CVE-2026-58248","CVE-2026-66760","CVE-2026-66761","CVE-2026-66763","CVE-2026-66764","CVE-2026-66770","CVE-2026-66771","CVE-2026-66772","CVE-2026-66773","CVE-2026-66774","CVE-2026-66775","CVE-2026-66776","CVE-2026-66777","CVE-2026-66778","CVE-2026-66779"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-55866","identifiers":["EUVD-2026-55866","CVE-2026-58230","GHSA-vhh6-v828-x62f"]},"retained":false,"historicalAffected":[]}],"coverage":[]}