---
id: CVE-2026-58239
title: >-
  SAP Approuter does not sufficiently validate tenant context in inbound
  requests
summary: >-
  SAP Approuter does not sufficiently validate tenant context in inbound
  requests. An unauthenticated attacker could send specially crafted requests to
  spoof the tenant context under conditions not fully within their control.
  Successful ex…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-807
vendor: sap
product: approuter
affected:
  - approuter < 23.0.0
patched:
  - approuter 23.0.0
published: '2026-08-11'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:20:20.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58239'
references:
  - url: 'https://me.sap.com/notes/3786038'
    label: cna@sap.com
  - url: 'https://url.sap/sapsecuritypatchday'
    label: cna@sap.com
tags:
  - nvd
epss: 0.00346
epssPercentile: 0.28003
ingestedAt: '2026-09-08T21:11:12.274Z'
---

## Overview

SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

## Affected

- `approuter < 23.0.0`

## Remediation

Upgrade past the affected range:

- `approuter 23.0.0`