ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32699

FacturaScripts is an open source accounting and invoicing software.

Published May 5, 2026 · updated Jul 25, 2026

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 5, 2026 · NIST NVD

    Detected

    FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including

  2. Jul 25, 2026 · NIST NVD

    Updated

    FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including

Sources

  • CVE.orgVulnerability recordCVE-2026-32699

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32699

    FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass t

    nvd.nist.gov

References

CVE-2026-32699 · ZeroDay Findings