CVE-2026-89106 · CVSS 3.0 4.4 · SAP Note 3799054
Custom URL allowlists deserve a close look when applying SAP Note 3799054. The correction changes how SAPUI5 treats entries that do not specify a protocol. Applications that render user-controlled or bound HTML can be exposed when those entries allow unsafe URL types through.
Configuration is part of the exposure
SAP rates CVE-2026-89106 at 4.4, Medium priority. The vector requires low privileges, high attack complexity and user interaction. The reported effects concern confidentiality and integrity within the victim’s browser; availability is unaffected. This is not a claim that every application using SAPUI5 is exploitable regardless of configuration.
Patch the UI5 runtime actually in use
SAP lists minimum fixed UI5 versions 1.38.70, 1.71.85, 1.84.62, 1.96.50, 1.108.56, 1.120.50, 1.136.23 and 1.148.10 on the corresponding supported branches. The change is also included in 1.152.0. Follow the note’s branch mapping and SAP Note 3155948 for the ABAP-delivered UI5 update procedure. Check the runtime loaded by the application, including deployments that use a separately hosted UI5 library.
Test custom allowlists before rollout
The fixed URLListValidator rejects dangerous protocols for unspecific allowlist entries by default. SAP calls out URLListValidator.add(), URLWhitelist.add() and jQuery.sap.addUrlWhitelist() for review. If a legitimate URL stops working, define the required protocol explicitly and narrowly. Entries added by one UI5 application can affect other UI5 applications on the same page, so testing a single app in isolation may miss a shared configuration problem. Avoid restoring broad unsafe schemes just to make a regression test pass.
Advisory details
Component: CA-UI5-COR
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 5
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3799054 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
