CVE-2026-22194

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-22194
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gestsup.fr/index.php?page=changelog Release Notes
https://www.vulncheck.com/advisories/gestsup-csrf-allows-privileged-actions Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:19

Type Values Removed Values Added
Summary
  • (es) Las versiones de GestSup hasta la 3.2.60 inclusive contienen una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) donde la aplicación no verifica la autenticidad de las peticiones del cliente. Un atacante puede inducir a un usuario autenticado a enviar peticiones manipuladas que realizan acciones con los privilegios de la víctima. Esto puede ser explotado para crear cuentas privilegiadas al atacar el punto final de creación de usuarios administrativos.

14 Jan 2026, 19:22

Type Values Removed Values Added
CPE cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Gestsup gestsup
Gestsup
References () https://gestsup.fr/index.php?page=changelog - () https://gestsup.fr/index.php?page=changelog - Release Notes
References () https://www.vulncheck.com/advisories/gestsup-csrf-allows-privileged-actions - () https://www.vulncheck.com/advisories/gestsup-csrf-allows-privileged-actions - Third Party Advisory

14 Jan 2026, 17:16

Type Values Removed Values Added
Summary (en) GestSup versions up to and including 3.2.56 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint. (en) GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.

09 Jan 2026, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-09 17:15

Updated : 2026-06-17 10:19

NVD link : CVE-2026-22194

Mitre link : CVE-2026-22194

CVE.ORG link : CVE-2026-22194

JSON object : View

Products Affected

gestsup

  • gestsup
CWE
CWE-352

Cross-Site Request Forgery (CSRF)