CVE-2026-76977 — Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

Description (CNA)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAPUI5(Frame Options Allowlist)	affected SAP_UI 750; affected 754; affected 755; affected 756; affected 757; affected 758; affected 816; affected UI_700 200

CWE

CWE-1289

References

https://me.sap.com/notes/3783189
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.