5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32699

CVE-2026-32699: FacturaScripts unauthorized modification of immutable nick field via EditUser controller

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32699

CVE-2026-32699:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
facturascripts/facturascripts	composer	<= 2024.92.x-dev

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly points to the EditUser controller and the failure to validate the nick parameter during a POST request. Analysis of the Core/Controller/EditUser.php file reveals the editAction method as the responsible function for handling this update logic. The provided source code includes a specific check to prevent the nick from being changed, which is evidently the patch for the vulnerability. The vulnerability, therefore, existed due to the absence of this validation logic in the editAction method. When this vulnerability is exploited, the EditUser::editAction function would be present in the runtime profile as it processes the malicious request. The parent::editAction() is subsequently called to persist the changes, but the initial point of failure is the lack of validation in the child controller.

Vulnerable functions

EditUser::editAction

Core/Controller/EditUser.php

The `editAction` function in the `EditUser` controller handles POST requests to update user information. In the vulnerable version, this function failed to validate the `nick` parameter, which is intended to be an immutable username. An authenticated user could intercept the request to edit a user profile and modify the `nick` parameter to a new value. The application would process this change, allowing the user to effectively rename their account or another user's account if they have administrative privileges. This leads to a broken access control vulnerability and can compromise the integrity of audit logs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.