CVE-2026-44767 Overview
CVE-2026-44767 is a client-side CSS injection vulnerability in the UI5 Web Components setThemeRoot() function. The function failed to enforce the sap-allowed-theme-origins allowlist before constructing a <link rel=stylesheet> element. An attacker-controlled absolute cross-origin URL can be stored and used directly, even when no <meta name=sap-allowed-theme-origins> tag is present. The same bypass is reachable via the ?sap-themeRoot URL parameter. The flaw is classified as Cross-Site Scripting [CWE-79] and enables loading of attacker-hosted stylesheets into the victim page context.
Critical Impact
Successful exploitation allows attackers to inject arbitrary CSS, enabling UI redressing, clickjacking, phishing overlays, visual defacement, and limited data exfiltration through CSS attribute selectors.
Affected Products
- SAP UI5 Web Components (@ui5/webcomponents)
- Applications embedding UI5 Web Components that expose setThemeRoot() or the sap-themeRoot URL parameter to attacker-influenced input
- SAP products bundling vulnerable UI5 Web Components versions (see SAP Security Patch Day advisory)
Discovery Timeline
- 2026-07-14 - CVE-2026-44767 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-44767
Vulnerability Analysis
The vulnerability resides in the theme resolution logic of UI5 Web Components. The setThemeRoot() API is designed to accept a URL from which the runtime loads the active theme stylesheet. To prevent loading of attacker-controlled resources, UI5 documents an allowlist mechanism using the <meta name=sap-allowed-theme-origins> tag. The origin check was not applied when the meta tag was absent from the document.
When this occurred, any absolute cross-origin URL passed to setThemeRoot() was treated as trusted and inserted into a dynamically created <link rel=stylesheet> element in the DOM. The runtime then fetched and applied the remote stylesheet with the privileges of the hosting page.
The same code path was exercised through the ?sap-themeRoot query string parameter, allowing exploitation through a crafted URL without requiring direct API access. Because loaded CSS runs in the origin of the victim application, attackers gain full styling control of the rendered UI.
Root Cause
The root cause is a missing enforcement step. The allowlist validation short-circuited when no sap-allowed-theme-origins meta tag was present, defaulting to allow-any rather than deny-by-default. This is an input validation failure combined with an insecure default configuration.
Attack Vector
Exploitation is network-based and requires user interaction, typically clicking a crafted link. The attacker supplies a malicious theme URL through a URL parameter, tenant configuration, or user-controlled setting that flows into setThemeRoot(). The victim's browser then loads the attacker's stylesheet from the external origin. Injected CSS can reposition elements over legitimate controls, hide security indicators, or extract predictable DOM content using attribute selectors combined with background-image requests.
No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-p8gx-753q-v89p for authoritative technical details.
Detection Methods for CVE-2026-44767
Indicators of Compromise
- Outbound requests from browsers to unexpected origins for .css resources referenced by UI5 pages
- HTTP access logs containing the sap-themeRoot query parameter with absolute URLs pointing to non-corporate hosts
- Dynamically inserted <link rel="stylesheet"> elements whose href attribute points outside the application origin
Detection Strategies
- Inspect application HTML for the presence of <meta name="sap-allowed-theme-origins"> and flag any UI5 deployment that omits it
- Review web server and reverse proxy logs for requests containing sap-themeRoot=http or sap-themeRoot=//
- Use browser Content Security Policy (CSP) reporting to surface stylesheet loads from unapproved origins
Monitoring Recommendations
- Enable CSP style-src reporting endpoints and forward violation reports to a centralized logging platform
- Monitor egress DNS and web proxy traffic for stylesheet fetches from newly registered or low-reputation domains referenced by UI5 applications
- Alert on modifications to tenant configuration fields or user settings that populate theme root values
How to Mitigate CVE-2026-44767
Immediate Actions Required
- Upgrade @ui5/webcomponents to the fixed version identified in GHSA-p8gx-753q-v89p
- Apply the corresponding SAP notes from the SAP Security Patch Day release covering UI5-based products
- Add an explicit <meta name="sap-allowed-theme-origins"> tag to every application document that uses UI5 Web Components
- Audit all call sites of setThemeRoot() and remove attacker-influenced inputs from reaching the function
Patch Information
Refer to the vendor advisory GHSA-p8gx-753q-v89p for the fixed release versions and to the SAP Security Patch Day portal for product-specific SAP Notes. The patch enforces the allowlist even when no meta tag is present, defaulting to same-origin only.
Workarounds
- Deploy a strict CSP restricting style-src and link sources to trusted origins to block loading of attacker-hosted stylesheets
- Strip or ignore the sap-themeRoot query parameter at a reverse proxy or web application firewall (WAF)
- Sanitize any tenant, user, or configuration inputs that feed setThemeRoot() to allow only relative paths or explicitly approved absolute URLs
# Example CSP header limiting stylesheet origins
Content-Security-Policy: default-src 'self'; style-src 'self' https://themes.example.com; img-src 'self' data:
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
