Read the docs
TI-2026-82363 Aliases CVE-2026-5702GHSA-3pwq-x9rx-xp23

Cross-site request forgery in SABBATIC app

Priority LOW 21CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

The SABBATIC app versions prior to 7.96.0.1 y 7.96.0.2 contain a cross-site request forgery flaw (CWE-352). An attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint. The attack requires the victim to be logged in and to interact with the attacker's content.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SABBATICSABBATIC appversions prior to 7.96.0.1 y 7.96.0.2—No fix listedCNA
  • SABBATIC app VendorSABBATIC Affected versions prior to 7.96.0.1 y 7.96.0.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for SABBATIC app.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-5702
  2. 2026-10-29 Alias added: GHSA-3pwq-x9rx-xp23
  3. 2026-10-29 CISA SSVC decision points changed

References

Other 1

  • TI-2026-82362 Stored cross-site scripting in SABBATIC app CVSS 4.0MEDIUM 4.8
  • TI-2026-82361 Stored cross-site scripting in SABBATIC app through company name CVSS 4.0MEDIUM 4.8
  • TI-2026-82360 Stored cross-site scripting in SABBATIC app CVSS 4.0MEDIUM 4.8
  • TI-2026-82359 Stored cross-site scripting in SABBATIC app via the nombre parameter CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences