cve.bz

CVE-2026-76969

9.4 criticalEPSS 0.4%

Critical (9.4). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in @sap/cds-mtxs 1.18.4, 2.7.7, 3.9.7.

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

Severity

CVSS 3.1

9.4 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
EPSS
0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE
CWE-522
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-955m-rr6m-2f9vnpm@sap/cds-mtxs>=4.0.1 <4.0.34.0.3
GHSA-955m-rr6m-2f9vnpm@sap/cds-mtxs>=3.0.1 <3.9.73.9.7
GHSA-955m-rr6m-2f9vnpm@sap/cds-mtxs>=2.0.2 <2.7.72.7.7
GHSA-955m-rr6m-2f9vnpm@sap/cds-mtxs<1.18.41.18.4

References

Check your stackJSON