CVE-2026-58239 - Multiple vulnerabilities in SAP Business AI Platform (Approuter)

Back Back to CVE browser

LOW

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

Published Aug 11, 2026

3.7

LOW

CVSS 3.1

EPSS 0.35%

Description

SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

Affected products

Vendor SAP SE Product SAP Business AI Platform (Approuter) Default
unaffected
- Version
  SAP Approuter node.js package < 23.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Business AI Platform (Approuter)

unaffected

Version	Status	Constraints
SAP Approuter node.js package < 23.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-807

References (2)

https://me.sap.com/notes/3786038
Permissions Required
https://url.sap/sapsecuritypatchday
Vendor Advisory

Link	Providers	Tags
https://me.sap.com/notes/3786038		Permissions Required
https://url.sap/sapsecuritypatchday		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Aug 11, 2026

Updated Aug 11, 2026

Reserved Jun 29, 2026

Link CVE-2026-58239

CISA Vulnrichment

Updated Aug 11, 2026

NVD

Status Analyzed

Modified Sep 8, 2026

Link CVE-2026-58239

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-58239