What is GHSA-955m-rr6m-2f9v?

GHSA-955m-rr6m-2f9v is a security advisory published by GitHub Security Advisories with Critical severity. @sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

Which CVE IDs does GHSA-955m-rr6m-2f9v cover?

GHSA-955m-rr6m-2f9v covers the following CVE IDs: CVE-2026-76969. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-955m-rr6m-2f9v?

GHSA-955m-rr6m-2f9v has a CVSS v3 base score of 9.4, published by GitHub Security Advisories.

Which products are affected by GHSA-955m-rr6m-2f9v?

GHSA-955m-rr6m-2f9v affects 4 products, including: npm/@sap/cds-mtxs:\u003e= 4.0.1, \u003c 4.0.3; npm/@sap/cds-mtxs:\u003e= 3.0.1, \u003c 3.9.7; npm/@sap/cds-mtxs:\u003e= 2.0.2, \u003c 2.7.7; npm/@sap/cds-mtxs:\u003c 1.18.4.

GHSA-955m-rr6m-2f9vCriticalCVSS 9.4

@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

Vendor

GitHub Security Advisories

Published

September 8, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-76969 →

📋 Description

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

🎯 Affected products4

npm/@sap/cds-mtxs:>= 4.0.1, < 4.0.3
npm/@sap/cds-mtxs:>= 3.0.1, < 3.9.7
npm/@sap/cds-mtxs:>= 2.0.2, < 2.7.7
npm/@sap/cds-mtxs:< 1.18.4

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-76969
https://me.sap.com/notes/3798315
https://url.sap/sapsecuritypatchday
https://github.com/advisories/GHSA-955m-rr6m-2f9v