CVE-2026-58239
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
Aug 11, 2026
CISA due date
—
The record
SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-50106 When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root… CWE-807
- CVE-2026-111748 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-807
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-807
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-807
- CVE-2026-87479 Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36… CWE-807
- CVE-2026-82533 DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability… CWE-807
- CVE-2026-66768 SAP GUI for Java does not correctly enforce the trust level policy for certain functions… CWE-807
- CVE-2026-85602 The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the… CWE-807