CVE-2026-76974 — Information Disclosure vulnerability in SAP Fiori Launchpad
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated…
Published: 2026-09-22 · CVSS: 5.3 · CVSS 3.1
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7