4.8
MediumCVSS 4.0 · from INCIBE
CVE-2026-5702
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
SABBATIC app · Cross-site request forgery · CWE-352AffectedSABBATIC app
FixNo fix listed yet.
PublishedOct 29, 11:17 · INCIBE
ScoredOct 29 · 4.8 · INCIBE
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
From INCIBE
Affected and fixed versions
ProductAffectedFixed inSABBATIC appversions prior to 7.96.0.1 y 7.96.0.2–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known