# CVE-2026-5702: SABBATIC Cross-Site Request Forgery vulnerability

Source: https://junglewise.ai/threats/cve-2026-5702-cross-site-request-forgery-csrf-vulnerability-in-sabbatic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-5702 · Severity: info · Published 2026-10-29

SABBATIC is a software application for digitizing expense receipts and invoices. A Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to trick authenticated users into performing unintended actions by clicking a malicious link or visiting a compromised page, potentially leading to unauthorized transactions or data modifications.

Technologies: [SABBATIC](https://junglewise.ai/threats/technologies/sabbatic). Vendors: [SABBATIC](https://junglewise.ai/threats/vendors/sabbatic).

## Quick answers

**Is CVE-2026-5702 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5702 being exploited in the wild.

**How severe is CVE-2026-5702?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** SABBATIC before 7.96.0.1.

**Is there a fix for CVE-2026-5702?** Yes: fixed in 7.96.0.1, 7.96.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5702 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-5702?** Check whether you run SABBATIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.96.0.1, 7.96.0.2

## Technical details

A CSRF vulnerability in SABBATIC permits an unauthenticated attacker to forge requests that an authenticated user unknowingly executes against vulnerable endpoints. The vulnerability requires user interaction (clicking a link or visiting a page) and authentication to an active session. An attacker could abuse this to perform unauthorized actions such as modifying expense reports, changing settings, or extracting data without the user's explicit consent.

## Affected products

- SABBATIC SABBATIC before 7.96.0.1

## Timeline

- 2026-10-29: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application)

## Related threats

- [SABBATIC stored cross-site scripting in /mis-gastos endpoint](https://junglewise.ai/threats/cve-2026-5700-stored-cross-site-scripting-xss-vulnerability-in-sabbatic)
- [SABBATIC stored cross-site scripting in categorías endpoint](https://junglewise.ai/threats/cve-2026-5698-stored-cross-site-scripting-xss-vulnerability-in-sabbatic)
- [SABBATIC stored cross-site scripting in user and form parameters](https://junglewise.ai/threats/cve-2026-5697-stored-cross-site-scripting-xss-vulnerability-in-sabbatic)