CVE-2026-5700 in Sabbatic
Summary
by MITRE • 10/29/2026
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'observaciones' in /mis-gastos endpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The SABBATIC application contains a stored Cross-Site Scripting vulnerability within its expense management module, specifically affecting the observaciones parameter at the mis-gastos endpoint. This flaw arises from insufficient input validation and improper encoding of user-supplied data before it is rendered in subsequent HTTP responses. Unlike reflected XSS attacks where malicious scripts are executed immediately via a crafted link, this stored variant persists on the target server because the injected JavaScript code is saved into the application's database or persistent storage mechanism. Consequently, every time an authorized user accesses the mis-gastos page to view their expenses, the browser retrieves and executes the embedded script alongside legitimate content, creating a persistent threat vector that does not require social engineering tricks like phishing links for each individual victim.
From a technical perspective, this vulnerability represents a classic case of improper neutralization of special elements used in an HTML-based output context, aligning with CWE-79 on OWASP Top Ten and MITRE ATT&CK technique T1059. The application fails to sanitize or encode characters such as angle brackets, quotes, and ampersands within the observaciones field before storing it. When the server generates the response for the mis-gastos endpoint, these unescaped special characters are interpreted by the browser's rendering engine as executable code rather than plain text data. This allows an attacker with write access to this specific parameter to inject arbitrary JavaScript payloads that run in the security context of the SABBATIC domain.
The operational impact of this vulnerability is significant because it compromises the confidentiality, integrity, and availability of user sessions and sensitive financial data. An attacker can exploit this flaw to steal session cookies or authentication tokens by exfiltrating them to a remote server controlled by the adversary using JavaScript commands like document.cookie retrieval combined with an HTTP request transmission. This enables account takeover without needing valid credentials. Furthermore, the vulnerability allows for phishing attacks where fake login forms are injected into the page to harvest user credentials directly from victims who believe they are interacting with the legitimate SABBATIC interface. In more advanced scenarios, attackers can perform actions on behalf of the victim, such as modifying expense records or initiating unauthorized transactions, thereby undermining the integrity of financial data managed within the application.
Mitigation strategies must focus on both immediate remediation and long-term defensive architecture improvements. The primary fix involves implementing strict output encoding for all dynamic content rendered in HTML contexts, ensuring that special characters are converted to their corresponding HTML entities before being sent to the client browser. Additionally, input validation should be enforced at the application layer to reject or sanitize any non-alphanumeric characters except those strictly required for text fields like observaciones. Deploying a Content Security Policy header can also mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby preventing inline script execution even if injection occurs. Regular security testing and code reviews should be integrated into the development lifecycle to prevent similar vulnerabilities in other endpoints that handle user-generated content.