CVE-2026-22194
GestSup <= 3.2.60 CSRF Allows Privileged Actions
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8.9EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
09 Jan 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H
Affected products
GestSup · GestSup