CVE-2026-59666 describes a Cross-Site Scripting vulnerability in the Repasat application. The flaw is located in the 'nomOrigen' parameter of the '/es/origins/store' endpoint. Successful exploitation enables an attacker to execute arbitrary code in the context of the victim's browser session, potentially leading to unauthorized actions or data exposure within the user's session. The vulnerability is confirmed published with CVSS version 4.0 metrics indicating network attack vector, low attack complexity, and requiring user interaction with limited privileges. No known exploits are reported in the wild, and no patch or remediation information is provided.

If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, unauthorized actions, or data theft within the application context. However, exploitation requires user interaction and low privileges, which limits the overall impact to medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content related to the affected parameter. Monitor vendor channels for updates and apply patches promptly once released.