CVE-2026-58237: SAP Approuter Auth Bypass Vulnerability

CVE-2026-58237 Overview

CVE-2026-58237 is a missing authorization vulnerability [CWE-862] in the WebSocket component of SAP Approuter. The component fails to perform sufficient authorization checks in certain functionality, allowing an authenticated attacker with low privileges to reach restricted features over the network. Successful exploitation exposes sensitive information and enables limited modifications to application data. The flaw does not affect availability. SAP disclosed the issue on the August 2026 Security Patch Day and released fixes referenced in SAP Note 3786038.

Critical Impact
An authenticated attacker with low privileges can bypass authorization on SAP Approuter WebSocket endpoints to read sensitive data and perform limited unauthorized modifications.

Affected Products

SAP Approuter (WebSocket component)
Refer to SAP Note 3786038 for the complete list of impacted versions
SAP August 2026 Security Patch Day advisories

Discovery Timeline

2026-08-11 - CVE-2026-58237 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-58237

Vulnerability Analysis

SAP Approuter routes HTTP and WebSocket traffic between clients and backend services in SAP Business Technology Platform (BTP) applications. It also enforces authentication and authorization decisions before forwarding requests. In vulnerable builds, the WebSocket handler does not consistently apply authorization checks across all routed functionality.

An attacker who already holds low-privilege credentials can open a WebSocket session and invoke functionality that should be restricted to higher-privileged users. The result is unauthorized read access to sensitive information and limited write access to application state. The attack requires network reachability to the Approuter endpoint and no user interaction.

The issue is classified as Missing Authorization [CWE-862]. Exploitation complexity is rated high, reflecting conditions the attacker must satisfy to reach the vulnerable code path.

Root Cause

The root cause is a missing or incomplete authorization check on specific WebSocket routes handled by Approuter. Authentication is validated, but the subsequent authorization step does not verify that the caller's scopes or roles permit the requested operation. Backend restrictions relying on Approuter for enforcement are therefore bypassed.

Attack Vector

The attack vector is network-based. An attacker authenticates to an application fronted by a vulnerable Approuter instance using any low-privilege account, then establishes a WebSocket connection to a restricted endpoint. Because the authorization layer is skipped for the affected functionality, the request is forwarded to the backend and processed as if authorized.

No verified public exploit code is available. Technical details are limited to the vendor advisory in SAP Note 3786038.

Detection Methods for CVE-2026-58237

Indicators of Compromise

WebSocket upgrade requests from low-privileged user sessions targeting administrative or restricted Approuter routes
Backend service logs showing successful operations from user accounts that should lack the required scope or role
Unusual volumes of WebSocket traffic from a single authenticated principal to sensitive endpoints

Detection Strategies

Correlate Approuter access logs with backend authorization decisions to surface requests processed without matching role assignments
Baseline normal WebSocket usage per user role and alert on deviations, especially reads of sensitive resources by low-privilege accounts
Review SAP BTP audit logs for scope mismatches between the authenticated token and the invoked service

Monitoring Recommendations

Enable verbose logging on Approuter for WebSocket upgrade and message events, including authenticated principal and destination route
Forward Approuter and backend logs to a centralized analytics platform for cross-source correlation and long-term retention
Add detection content for anomalous privilege-to-endpoint mappings and repeated authorization failures followed by successful WebSocket sessions

How to Mitigate CVE-2026-58237

Immediate Actions Required

Apply the SAP-provided patch documented in SAP Note 3786038 to all Approuter instances
Inventory every deployment of @sap/approuter across BTP subaccounts and self-hosted environments to confirm patch coverage
Rotate credentials and review recent WebSocket activity for any accounts that may have exercised the vulnerable path

Patch Information

SAP released the fix on the August 2026 Security Patch Day. Patch details, affected versions, and update instructions are provided in SAP Note 3786038 and the SAP Security Patch Day portal. Administrators must authenticate to the SAP support portal to retrieve the note.

Workarounds

Restrict WebSocket routes in the Approuter xs-app.json configuration to only the scopes required by each endpoint until patching completes
Enforce backend-side authorization checks so that Approuter is not the sole enforcement point for sensitive operations
Limit network exposure of Approuter administrative routes using ingress controls or reverse proxy rules

bash

# Example xs-app.json route hardening - require an explicit scope for WebSocket routes
{
  "source": "^/ws/admin/(.*)$",
  "target": "/admin/$1",
  "destination": "backend",
  "authenticationType": "xsuaa",
  "scope": "$XSAPPNAME.Admin",
  "csrfProtection": true
}