The setThemeRoot() function in the SAP UI5 Web Components Base library is intended to load theme styles only from approved origins. However, it fails to enforce the sap-allowed-theme-origins allowlist, allowing an attacker-controlled absolute cross‑origin URL to be stored and later used to insert a <link rel=stylesheet> directly into a page. When the victim page loads the injected stylesheet, the attacker can supply any CSS, enabling UI redressing, clickjacking, phishing overlays, visual defacement, or limited data exfiltration through CSS attribute selectors. This behavior is a classic web content injection flaw classified as CWE‑79.

The flaw affects any deployment of the SAP UI5 Web Components Base library that exposes the setThemeRoot() API to external input. Since no specific version range is provided, all releases of the library that include the setThemeRoot() function are potentially vulnerable until SAP releases a fix that correctly enforces the allowlist.

The CVSS score of 6.1 indicates moderate severity, but the EPSS score of less than 1 % shows that exploitation is currently considered very unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to influence input to setThemeRoot()—for example, via a URL query parameter, tenant configuration setting, or user‑supplied value. Successful exploitation permits injection of arbitrary CSS but does not provide code execution or system compromise.