---
id: CVE-2026-5702
title: Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
summary: >-
  Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that
  allows an attacker can trick an authenticated user into clicking a malicious
  link or loading a page that sends unauthorized requests to a vulnerable
  endpoint.
severity: medium
cvss: 4.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-352
vendor: SABBATIC
product: SABBATIC app
affected:
  - app versions prior to 7.96.0.1 y 7.96.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T12:53:13.074601Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T13:07:11.657Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-5702'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.07305
ingestedAt: '2026-11-01T18:59:04.475Z'
---

## Overview

Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.

## Affected

- `app versions prior to 7.96.0.1 y 7.96.0.2`

## Remediation

The vulnerabilities have been fixed by SABBATIC team in versions 7.96.0.1 y 7.96.0.2