SAP_SE SAP Cloud Application Programming Model (CAP) vulnerabilities

Latest SAP_SE SAP Cloud Application Programming Model (CAP) CVEs

Newest publication first

1. CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

   Published 2026-09-08

   Critical·CVSS 9.4 EPSS 0.44%

   @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or de...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.