CVE-2026-59663 describes a Cross-Site Scripting vulnerability in the Repasat application. The flaw is located in the 'nomDelegacion' parameter of the '/es/delegations/store' endpoint. Successful exploitation enables an attacker to execute arbitrary code in the context of the victim's browser session. The vulnerability has been published with a medium severity rating. No known exploits in the wild or vendor patches are currently documented.

If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited to user interaction since user interface interaction is required (UI:A). No privilege escalation or direct system compromise is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content in the affected application. No official fix or workaround has been documented at this time.