This vulnerability (CVE-2026-66771) in SAPUI5 involves improper neutralization of input during web page generation (CWE-79). A key user with content adaptation privileges can inject malicious script content into persisted application changes. When another user opens the adapted application, the injected script executes in the victim's browser session, potentially allowing the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim. The vulnerability affects specific SAPUI5 versions (=754, =755, =756, =757, =758, =816). The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to unauthorized access to sensitive session data and unauthorized actions performed in the context of the victim's browser session. This results in a high impact on confidentiality and integrity of the affected SAPUI5 applications. There is no impact on availability.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, limit key user content adaptation privileges to trusted personnel only and monitor for suspicious activity related to application changes.