{"answers":{"affected":"2 open source packages ship an affected version, including facturascripts/facturascripts.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32699 exists.","fix":"No fix has been published for CVE-2026-32699 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-32699 is a medium-severity missing authorization vulnerability in NeoRazorX facturascripts, published on 5 May 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-32699 and fix it if it is affected.\n\nWhat it is: CVE-2026-32699 is a medium-severity missing authorization vulnerability in NeoRazorX facturascripts, published on 5 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32699 exists.\n\nAffected packages and fixed versions:\n- facturascripts/facturascripts (Packagist): affected all versions up to 2024.92.x-dev; no fix listed\n- facturascripts/facturascripts (Packagist): affected all versions up to 2024.92.x-dev; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-32699/ (Markdown: https://insights.sbomify.com/CVE-2026-32699/index.md)","id":"CVE-2026-32699","markdown":"https://insights.sbomify.com/CVE-2026-32699/index.md","name":"CVE-2026-32699","record":{"aliases":["GHSA-pp79-hqv6-vmc3"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_modify","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Accounting invoicing software","requires_auth":"low_privilege","summary":"Attackers can bypass UI restrictions to modify immutable user nicknames, potentially renaming administrator accounts in FacturaScripts.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-472","name":"External Control of Assumed-Immutable Web Parameter"}],"description":"FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":"2026-04-25","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-04-25T20:15:16Z","kind":"github_poc","ref":"https://github.com/TurkiOS/cve-2026-32699-facturascripts-nick-bypass","stars":0,"title":"Broken Access Control in FacturaScripts EditUser controller allows authenticated users to rename any account (including admin) by modifying the unvalidated nick parameter via proxy interception. Patched but unpublished CVE."}],"tier":"weaponised"},"has_fix":false,"headline":"FacturaScripts unauthorized modification of immutable nick field via EditUser controller","id":"CVE-2026-32699","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"Devise has a confirmable \"change email\" race condition that permits user to confirm email they have no access to","id":"CVE-2026-32700"},"packages":[{"ecosystem":"Packagist","fixed":[],"introduced":["0"],"last_affected":["2024.92.x-dev"],"package":"facturascripts/facturascripts","purl":null,"source":"GHSA-pp79-hqv6-vmc3"},{"ecosystem":"Packagist","fixed":[],"introduced":["0"],"last_affected":["2024.92.x-dev"],"package":"facturascripts/facturascripts","purl":"pkg:composer/facturascripts/facturascripts","source":"GHSA-pp79-hqv6-vmc3"}],"prev":{"headline":"OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution","id":"CVE-2026-32698"},"products":["facturascripts"],"published":"2026-05-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-05","vendors":["NeoRazorX"]},"summary":"Attackers can bypass UI restrictions to modify immutable user nicknames, potentially renaming administrator accounts in FacturaScripts.","url":"https://insights.sbomify.com/CVE-2026-32699/"}