CVE-2026-76974: Information Disclosure vulnerability in SAP Fiori Launchpad
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated SAP Fiori Launchpad users are the victims of exploitation. An unauthenticated attacker can initiate the attack, but the target user must click a malicious link.
What conditions are required for exploitation?
The attacker must craft a malicious link and persuade an authenticated user to open it. Exploitation has high attack complexity and requires user interaction; no attacker privileges are required.
What is the potential impact?
The issue may allow sensitive information from the authenticated victim's session to be exfiltrated to attacker-controlled external content. The stated impact is limited to confidentiality, with no integrity or availability impact described.