{"id":"CVE-2026-5702","aliases":[],"cve":{"records":[{"id":"CVE-2026-5702","source":"INCIBE","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-04-06T12:48:15.541Z","published":"2026-10-29T11:17:09.384Z","modified":"2026-10-29T13:07:11.657Z"}],"publishers":[{"name":"INCIBE","role":"CNA","organizationId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","modified":"2026-10-29T11:17:09.384Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T13:07:11.657Z"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application","tags":[],"source":"INCIBE"}],"weaknesses":[{"id":"CWE-352","description":"CWE-352 Cross-Site request forgery (CSRF)","source":"INCIBE"}],"applicability":[{"source":"INCIBE","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sabbatic:sabbatic_app:versions_prior_to_7.96.0.1_y_7.96.0.2:*:*:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T12:53:13.074601Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application","titleSource":"INCIBE","descriptionSource":"INCIBE","description":"Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.","score":4.8,"severity":"medium","published":"2026-10-29T11:17:09.384Z","modified":"2026-10-29T13:07:11.657Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"SABBATIC","name":"SABBATIC app","platforms":[],"versions":[{"version":"versions prior to 7.96.0.1 y 7.96.0.2","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-5702"}],"remediation":[{"text":"The vulnerabilities have been fixed by SABBATIC team in versions 7.96.0.1 y 7.96.0.2","source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-5702"}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application"],"sources":[{"name":"CVE","id":"CVE-2026-5702","modified":"2026-10-29T13:07:11.657Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-5702"}],"assessments":[{"source":"INCIBE","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":4.8}],"sourceAffected":[],"observedAt":"2026-10-29T14:16:22.223Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T02:05:32.990Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"A Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application versions prior to 7.96.0.1 and 7.96.0.2 allows an attacker to trick an authenticated user into sending unauthorized requests. The attacker needs the user to click a malicious link or load a page. The impact is unauthorized requests to a vulnerable endpoint.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:16:26.747Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-5702"}]}}