Medium severity · published Oct 29, 2026
CVE-2026-5702
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
New
4.8
CVSS
–
EPSS
No
On KEV
Description
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SABBATIC app · SABBATIC
versions prior to 7.96.0.1 y 7.96.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5702
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5702
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application
More from SABBATIC app
4.8
CVE-2026-5700
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
4.8
CVE-2026-5699
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
4.8
CVE-2026-5698
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
4.8
CVE-2026-5697
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application