CVE-2026-58239
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
Risk Assessment
The risk for the organization is potential data leakage between tenants in a multi-tenant environment, which may compromise confidentiality. Low impact on confidentiality still requires monitoring and safeguards.
Recommendation
Update Approuter to a patched version and strengthen tenant context validation. Also monitor traffic for attempts to spoof context.
Original NVD description (English source)
SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.