Cross-Site Request Forgery Vulnerability in GestSup Application
CVE-2026-22194

8.9HIGH

Key Information:

Vendor

Gestsup

Status
Gestsup
Vendor
CVE Published:
9 January 2026

What is CVE-2026-22194?

The GestSup application, up to and including version 3.2.60, is susceptible to a cross-site request forgery (CSRF) vulnerability. This issue arises from the application failing to validate the authenticity of client requests. An attacker can exploit this flaw by tricking a logged-in user into executing crafted requests, thereby executing actions with the user's privileges. This vulnerability specifically allows unauthorized creation of privileged accounts by targeting the administrative user creation endpoint, posing significant security risks to affected systems.

Affected Version(s)

GestSup 0 <= 3.2.60

References

https://gestsup.fr/index.php?page=changelog
release-notes
https://www.vulncheck.com/advisories/gestsup-csrf-allows-...
third-party-advisory

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert and Valentin Holubec of Akailabs
VulnCheck
.