FacturaScripts CVE-2026-32699

Q: What is the CVSS score of CVE-2026-32699?

CVE-2026-32699 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27438 MEDIUM

Improper Access Control (CWE-284)

2026-04-28 https://github.com/NeoRazorX/facturascripts

GHSA-pp79-hqv6-vmc3

Authentication Bypass

5.3

CVSS 4.0 · Vendor: https://github.com/NeoRazorX/facturascripts

Severity by source

Vendor (https://github.com/NeoRazorX/facturascripts) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requiring an authenticated session (PR:L); integrity impact limited to username field; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/NeoRazorX/facturascripts).

CVSS VectorVendor: https://github.com/NeoRazorX/facturascripts

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 03:46 vuln.today

Analysis Generated

Jul 24, 2026 - 03:46 vuln.today

CVSS changed

May 05, 2026 - 20:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

CVE Published

Apr 28, 2026 - 22:39 nvd

MEDIUM 4.3

DescriptionCVE.org

Summary

The application fails to validate the `nick` parameter during a `POST` request to the `EditUser` controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account (including the Administrator). This leads to Broken Access Control and potential Audit Log Corruption.

Details

The vulnerability exists in the user update logic. When a `POST` request is sent to `/EditUser`, the backend processes the `nick` form-data parameter without checking if it matches the original value or if the user has the privilege to change a unique identifier that is intended to be immutable.

PoC

*1.* Log in to the dashboard as any user (e.g. admin user).

*2.* Go to your Profile by clicking your username/avatar in the top right.

*3.* Open Burp Suite and ensure Intercept is ON.

*5.* Click the Save button in the UI.

*6.* In Burp Suite, locate `nick` in the body:

*7.* Change the value admin to Vulnerable (or any other string).

*8.* Click Forward in Burp Suite.

The application will log the user out. It is possible to now log back in using the username "Vulnerable" and the original password.

Impact

An attacker can effectively sabotage the system’s audit trail, performing malicious actions and then renaming their account to evade detection or frame other users. This breakdown in accountability facilitates identity impersonation and risks data corruption, as internal references to the original username become orphaned, undermining the overall integrity of the multi-user environment.

Result

Before

After

AnalysisAI

Unauthorized modification of the immutable nick (username) field in FacturaScripts allows any authenticated user to rename any account - including the Administrator - by intercepting a POST request to /EditUser and altering the nick form-data parameter before it reaches the backend. The backend performs no server-side validation of immutability or caller privilege, relying solely on UI-layer controls that are trivially bypassed with a proxy. A public proof-of-concept exists demonstrating the full attack; no vendor-released patch has been identified at time of analysis, leaving all deployments on affected versions exposed.

Technical ContextAI

FacturaScripts is an open-source ERP and accounting application distributed as a Composer package (pkg:composer/facturascripts/facturascripts), primarily targeting Spanish-speaking SMB markets. The vulnerability resides in the EditUser controller's user update logic: when a POST request is submitted to /EditUser, the backend processes the nick form-data parameter - a field intended as a permanent, unique user identifier - without enforcing immutability or verifying that the requesting session has authority to alter it. CWE-284 (Improper Access Control) is the root cause class: the application implements access control only at the presentation layer (disabling the field in the UI) rather than at the server layer, a classic security antipattern. Because HTTP POST parameters are fully attacker-controlled, stripping or modifying the nick value with an intercepting proxy bypasses all protection. Affected versions per EUVD (EUVD-2026-27438) are facturascripts <= 2025.92; the Composer-derived CPE places the vulnerable range at <= 2024.92.x-dev.

RemediationAI

No vendor-released patch has been identified at time of analysis; the fixed version field in the advisory is empty. Administrators should implement compensating controls immediately: add server-side validation in the EditUser controller to reject any incoming nick value that differs from the current session user's stored nick, or strip the nick parameter entirely from inbound POST bodies before database persistence - this eliminates the attack surface without requiring application downtime. Alternatively, enforce user-ID-to-session binding at the server so the account being modified is always derived from the authenticated session rather than from a user-supplied parameter. Web server or WAF rules can block or flag POST requests to /EditUser where the nick parameter does not match the session-authenticated username, though this requires careful tuning to avoid false positives. Monitor web access and application logs for POST requests to /EditUser containing unexpected nick values as a detection measure. Track the upstream repository at https://github.com/NeoRazorX/facturascripts for patch releases and apply as soon as a fixed version is published.