The flaw is a cross‑site request forgery that allows an attacker to cause a logged‑in user to submit requests that the application will execute with the victim’s privileges. This can be leveraged against the administrative account creation endpoint to create new privileged accounts without the need for valid credentials. The result is an elevation of privilege that grants the attacker full control over the application and its data.

GestSup deployments of versions 3.2.60 and earlier are affected. The issue is present in all copies of the software up to and including 3.2.60, regardless of the hosting environment, as the vendor’s change log indicates the vulnerability persists through that release.

The vulnerability has a CVSS score of 8.9, classifying it as high severity. The likelihood of exploitation is very low, recorded below 1% for exploit probability, and there are no current reports of exploitation in the Known Exploited Vulnerabilities catalog. The attack requires a user with an authenticated session and a method to persuade that user to submit a crafted request, such as a malicious link or embedded form. No additional credentials or system access are needed beyond the victim’s authenticated session.