Critical severity9.4NVD Advisory· Published Sep 8, 2026· Updated Sep 8, 2026
CVE-2026-76969
CVE-2026-76969
Description
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@sap/cds-mtxsnpm | >= 4.0.1, < 4.0.3 | 4.0.3 |
@sap/cds-mtxsnpm | >= 3.0.1, < 3.9.7 | 3.9.7 |
@sap/cds-mtxsnpm | >= 2.0.2, < 2.7.7 | 2.7.7 |
@sap/cds-mtxsnpm | < 1.18.4 | 1.18.4 |
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-955m-rr6m-2f9vghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-76969ghsaADVISORY
- me.sap.com/notes/3798315nvdWEB
- url.sap/sapsecuritypatchdaynvdWEB
News mentions
4- SAP Patches Maximum Severity “Overpass” FlawInfosecurity Magazine · Sep 9, 2026
- SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code ExecutionThe Hacker News · Sep 9, 2026
- SAP Patches Critical Extended Passport Processing VulnerabilitySecurityWeek · Sep 8, 2026
- SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended PassportCyber Security News · Sep 8, 2026