CVE-2026-5702
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability in the SABBATIC application allows an attacker to trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
Risk Assessment
An attacker can perform actions on behalf of a logged-in user without their knowledge, potentially leading to unauthorized data or configuration changes. The risk affects all authenticated SABBATIC users.
Recommendation
Implement CSRF protections (anti-CSRF tokens, Origin/Referer header validation) and update the application to a version containing the fix.
Other vulnerabilities in SABBATIC
See all- CVE-2026-5700Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'observaciones' in the /mis-gastos endpoint.
- CVE-2026-5699Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'companyName' in the /empresa endpoint.
- CVE-2026-5698Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameters are 'titulo_es' and 'add_etiquetas[]' in the /categorías endpoint.
- CVE-2026-5697Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application allows an attacker to store JavaScript code that executes in the victim's browser when the page is viewed. The affected parameter is 'nombre' in the /usuario endpoint.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS