CVE-2026-32699

Katalog CVE

CVSS 5.3 · Medium EPSS 0,41%

Kerentanan External Control of Assumed-Immutable Web Parameter. Skor CVSS 4.0 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

25 Juli 2026

Status NVD

Deferred

CVSS 4.0

5.3 (Medium), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-472: External Control of Assumed-Immutable Web Parameter

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pp79-hqv6-vmc3