CVE-2026-89106

MediumCVSS 4.4/10Last modified Oct 15, 2026

Description

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-183

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-891079.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that util CVE-2026-891089.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative function CVE-2026-89116.1The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to CVE-2026-891109.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privile CVE-2026-8911110.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the ten CVE-2026-891126.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the targe CVE-2026-891138.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authentica CVE-2026-891165.9The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to CVE-2026-891176.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-891185.3SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application info CVE-2026-89127.5The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.CVE-2026-891207.1A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be