Gestsup
CVE-2026-22194
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.
AnalysisAI
GestSup through version 3.2.60 fails to implement CSRF protections, enabling attackers to forge requests that execute actions with a victim's privileges when they visit a malicious site. An unauthenticated attacker can exploit this to create privileged administrative accounts by targeting logged-in users, with no patch currently available to remediate the vulnerability.
Technical ContextAI
Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects Gestsup. GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). Rated critical sever
GestSup versions before 3.2.60 allow authenticated attackers to execute SQL injection attacks through insufficiently san
GestSup prior to version 3.2.60 is vulnerable to SQL injection in the ticket creation feature, allowing authenticated at
Authenticated attackers can exploit SQL injection in GestSup's search functionality (versions before 3.2.60) to manipula
GestSup before version 3.2.60 contains a pre-authentication stored XSS vulnerability in API error logging that allows un
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today