Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-76969 · CVE overview and exploitation status

EUVD-2026-72586

GHSA-955m-rr6m-2f9v

cve-program · CVE-2026-76969

• https://me.sap.com/notes/3798315
• https://url.sap/sapsecuritypatchday

euvd · EUVD-2026-72586

• https://me.sap.com/notes/3798315
• https://url.sap/sapsecuritypatchday

nvd · CVE-2026-76969

• https://me.sap.com/notes/3798315
• https://url.sap/sapsecuritypatchday

osv · GHSA-955m-rr6m-2f9v

• https://nvd.nist.gov/vuln/detail/CVE-2026-76969
• https://me.sap.com/notes/3798315
• https://url.sap/sapsecuritypatchday

• @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive cre… · Advisory content revised · 15 Nov 2026