CVE-2026-32699CWE-472

FacturaScripts unauthorized modification of immutable nick field via EditUser controller

Medium · published May 5, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00406 · 33.7th percentile
Weakness
CWE-472 · External Control of Assumed-Immutable Web Parameter
Published
2026-05-05T19:00Z
EPSS history
Timeline
  • 05 MAY 19:00Z
    FacturaScripts unauthorized modification of immutable nick field via EditUser controller
    cvelistv5