SB20261109203 - Multiple vulnerabilities in FacturaScripts

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-77530)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged attacker with ListCuenta page access to corrupt the special-account mappings used to generate accounting entries in FacturaScripts.

The vulnerability exists due to missing authorization checks in the ListCuenta restore-special handler when processing a direct GET request. A low-privileged attacker can invoke /ListCuenta?action=restore-special to overwrite the mappings with packaged defaults without administrator privileges or victim interaction.

2) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated attacker to disable plugins or apply staged core updates in FacturaScripts, compromising code integrity and availability.

The vulnerability exists due to missing anti-CSRF validation on state-changing GET actions in the Updater controller, with authenticated cookies sent during cross-site top-level navigation. An unauthenticated attacker can lure an authenticated administrator to a crafted link that executes these actions with the victim's privileges, provided an update archive is already staged when applying updates.

Remediation

Install update from vendor's website.

References

• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-f9xh-7rcj-jc8j
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-8cqc-qp9f-j36c