GHSA-PP79-HQV6-VMC3
Vulnerability from github – Published: 2026-04-28 22:39 – Updated: 2026-04-28 22:39Summary
The application fails to validate the nick parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account (including the Administrator). This leads to Broken Access Control and potential Audit Log Corruption.
Details
The vulnerability exists in the user update logic. When a POST request is sent to /EditUser, the backend processes the nick form-data parameter without checking if it matches the original value or if the user has the privilege to change a unique identifier that is intended to be immutable.
PoC
1. Log in to the dashboard as any user (e.g. admin user).
2. Go to your Profile by clicking your username/avatar in the top right.
3. Open Burp Suite and ensure Intercept is ON.
5. Click the Save button in the UI.
6. In Burp Suite, locate nick in the body:
7. Change the value admin to Vulnerable (or any other string).
8. Click Forward in Burp Suite.
The application will log the user out. It is possible to now log back in using the username "Vulnerable" and the original password.
Impact
An attacker can effectively sabotage the system’s audit trail, performing malicious actions and then renaming their account to evade detection or frame other users. This breakdown in accountability facilitates identity impersonation and risks data corruption, as internal references to the original username become orphaned, undermining the overall integrity of the multi-user environment.
Result
Before
After
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "facturascripts/facturascripts"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2024.92.x-dev"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32699"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-28T22:39:01Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nThe application fails to validate the ```nick``` parameter during a ```POST``` request to the ```EditUser``` controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account (including the Administrator). This leads to Broken Access Control and potential Audit Log Corruption.\n\n### Details\nThe vulnerability exists in the user update logic. When a ```POST``` request is sent to ```/EditUser```, the backend processes the ```nick``` form-data parameter without checking if it matches the original value or if the user has the privilege to change a unique identifier that is intended to be immutable.\n\n### PoC\n***1.*** Log in to the dashboard as any user (e.g. admin user).\n\n***2.*** Go to your Profile by clicking your username/avatar in the top right.\n\n***3.*** Open Burp Suite and ensure Intercept is ON.\n\n***5.*** Click the Save button in the UI.\n\n***6.*** In Burp Suite, locate ```nick``` in the body:\n\n\u003cimg width=\"1915\" height=\"1013\" alt=\"Screenshot_2026-03-04_05_26_32\" src=\"https://github.com/user-attachments/assets/aea4e6fd-beba-4a47-96da-8b9bd9075681\" /\u003e\n\n\n***7.*** Change the value admin to Vulnerable (or any other string).\n\n***8.*** Click Forward in Burp Suite.\n\nThe application will log the user out. It is possible to now log back in using the username \"Vulnerable\" and the original password.\n\n### Impact\nAn attacker can effectively sabotage the system\u2019s audit trail, performing malicious actions and then renaming their account to evade detection or frame other users. This breakdown in accountability facilitates identity impersonation and risks data corruption, as internal references to the original username become orphaned, undermining the overall integrity of the multi-user environment.\n\n### Result\n\n#### Before \n\n\u003cimg width=\"1920\" height=\"996\" alt=\"Screenshot_2026-03-04_05_25_30\" src=\"https://github.com/user-attachments/assets/3b2d34e5-a2b9-4da9-9a56-963fe1a8fd65\" /\u003e\n\n#### After\n\n\u003cimg width=\"1920\" height=\"955\" alt=\"Screenshot_2026-03-04_05_27_00\" src=\"https://github.com/user-attachments/assets/af1de0ef-2b55-4d29-9557-29ee26a3775a\" /\u003e",
"id": "GHSA-pp79-hqv6-vmc3",
"modified": "2026-04-28T22:39:01Z",
"published": "2026-04-28T22:39:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pp79-hqv6-vmc3"
},
{
"type": "PACKAGE",
"url": "https://github.com/NeoRazorX/facturascripts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable \u0027nick\u0027 Field"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.