Vulnerability Details CVE-2026-22194
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 8.2%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-22194
-
cpe:2.3:a:gestsup:gestsup:-
-
cpe:2.3:a:gestsup:gestsup:3.1.15
-
cpe:2.3:a:gestsup:gestsup:3.1.16
-
cpe:2.3:a:gestsup:gestsup:3.1.17
-
cpe:2.3:a:gestsup:gestsup:3.1.18
-
cpe:2.3:a:gestsup:gestsup:3.1.19
-
cpe:2.3:a:gestsup:gestsup:3.1.20
-
cpe:2.3:a:gestsup:gestsup:3.1.21
-
cpe:2.3:a:gestsup:gestsup:3.1.22
-
cpe:2.3:a:gestsup:gestsup:3.1.23
-
cpe:2.3:a:gestsup:gestsup:3.1.24
-
cpe:2.3:a:gestsup:gestsup:3.1.25
-
cpe:2.3:a:gestsup:gestsup:3.1.26
-
cpe:2.3:a:gestsup:gestsup:3.1.27
-
cpe:2.3:a:gestsup:gestsup:3.1.28
-
cpe:2.3:a:gestsup:gestsup:3.1.29
-
cpe:2.3:a:gestsup:gestsup:3.1.30
-
cpe:2.3:a:gestsup:gestsup:3.1.31
-
cpe:2.3:a:gestsup:gestsup:3.1.32
-
cpe:2.3:a:gestsup:gestsup:3.1.33
-
cpe:2.3:a:gestsup:gestsup:3.1.34
-
cpe:2.3:a:gestsup:gestsup:3.1.35
-
cpe:2.3:a:gestsup:gestsup:3.1.36
-
cpe:2.3:a:gestsup:gestsup:3.1.37
-
cpe:2.3:a:gestsup:gestsup:3.1.38
-
cpe:2.3:a:gestsup:gestsup:3.1.39
-
cpe:2.3:a:gestsup:gestsup:3.1.40
-
cpe:2.3:a:gestsup:gestsup:3.1.41
-
cpe:2.3:a:gestsup:gestsup:3.1.42
-
cpe:2.3:a:gestsup:gestsup:3.1.43
-
cpe:2.3:a:gestsup:gestsup:3.1.44
-
cpe:2.3:a:gestsup:gestsup:3.1.45
-
cpe:2.3:a:gestsup:gestsup:3.1.46
-
cpe:2.3:a:gestsup:gestsup:3.1.47
-
cpe:2.3:a:gestsup:gestsup:3.1.48
-
cpe:2.3:a:gestsup:gestsup:3.1.49
-
cpe:2.3:a:gestsup:gestsup:3.1.50
-
cpe:2.3:a:gestsup:gestsup:3.2.0
-
cpe:2.3:a:gestsup:gestsup:3.2.1
-
cpe:2.3:a:gestsup:gestsup:3.2.10
-
cpe:2.3:a:gestsup:gestsup:3.2.11
-
cpe:2.3:a:gestsup:gestsup:3.2.12
-
cpe:2.3:a:gestsup:gestsup:3.2.13
-
cpe:2.3:a:gestsup:gestsup:3.2.14
-
cpe:2.3:a:gestsup:gestsup:3.2.15
-
cpe:2.3:a:gestsup:gestsup:3.2.16
-
cpe:2.3:a:gestsup:gestsup:3.2.17
-
cpe:2.3:a:gestsup:gestsup:3.2.18
-
cpe:2.3:a:gestsup:gestsup:3.2.19
-
cpe:2.3:a:gestsup:gestsup:3.2.2
-
cpe:2.3:a:gestsup:gestsup:3.2.20
-
cpe:2.3:a:gestsup:gestsup:3.2.21
-
cpe:2.3:a:gestsup:gestsup:3.2.22
-
cpe:2.3:a:gestsup:gestsup:3.2.23
-
cpe:2.3:a:gestsup:gestsup:3.2.24
-
cpe:2.3:a:gestsup:gestsup:3.2.25
-
cpe:2.3:a:gestsup:gestsup:3.2.26
-
cpe:2.3:a:gestsup:gestsup:3.2.27
-
cpe:2.3:a:gestsup:gestsup:3.2.28
-
cpe:2.3:a:gestsup:gestsup:3.2.29
-
cpe:2.3:a:gestsup:gestsup:3.2.3
-
cpe:2.3:a:gestsup:gestsup:3.2.30
-
cpe:2.3:a:gestsup:gestsup:3.2.31
-
cpe:2.3:a:gestsup:gestsup:3.2.32
-
cpe:2.3:a:gestsup:gestsup:3.2.33
-
cpe:2.3:a:gestsup:gestsup:3.2.34
-
cpe:2.3:a:gestsup:gestsup:3.2.35
-
cpe:2.3:a:gestsup:gestsup:3.2.36
-
cpe:2.3:a:gestsup:gestsup:3.2.37
-
cpe:2.3:a:gestsup:gestsup:3.2.38
-
cpe:2.3:a:gestsup:gestsup:3.2.39
-
cpe:2.3:a:gestsup:gestsup:3.2.4
-
cpe:2.3:a:gestsup:gestsup:3.2.40
-
cpe:2.3:a:gestsup:gestsup:3.2.41
-
cpe:2.3:a:gestsup:gestsup:3.2.42
-
cpe:2.3:a:gestsup:gestsup:3.2.43
-
cpe:2.3:a:gestsup:gestsup:3.2.44
-
cpe:2.3:a:gestsup:gestsup:3.2.45
-
cpe:2.3:a:gestsup:gestsup:3.2.46
-
cpe:2.3:a:gestsup:gestsup:3.2.47
-
cpe:2.3:a:gestsup:gestsup:3.2.48
-
cpe:2.3:a:gestsup:gestsup:3.2.49
-
cpe:2.3:a:gestsup:gestsup:3.2.5
-
cpe:2.3:a:gestsup:gestsup:3.2.50
-
cpe:2.3:a:gestsup:gestsup:3.2.51
-
cpe:2.3:a:gestsup:gestsup:3.2.52
-
cpe:2.3:a:gestsup:gestsup:3.2.53
-
cpe:2.3:a:gestsup:gestsup:3.2.54
-
cpe:2.3:a:gestsup:gestsup:3.2.55
-
cpe:2.3:a:gestsup:gestsup:3.2.56
-
cpe:2.3:a:gestsup:gestsup:3.2.6
-
cpe:2.3:a:gestsup:gestsup:3.2.7
-
cpe:2.3:a:gestsup:gestsup:3.2.8
-
cpe:2.3:a:gestsup:gestsup:3.2.9