CVE-2026-66776

Name of the Vulnerable Software and Affected Versions SAP Approuter (affected versions not specified)

Description SAP Approuter fails to consistently enforce integrity verification on specific session-related request headers. A low-privileged attacker can send a specially crafted request to bypass this integrity check and load the session context of another user. This attack is complex as it requires the attacker to have previously obtained matching session values through out-of-band means. This issue may lead to a high impact on confidentiality and a low impact on integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.