Information disclosure in FacturaScripts - #VU163115
Published: November 9, 2026
Vulnerability identifier: #VU163115
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker with an API key granting read access to users to take over any FacturaScripts account, including administrator accounts.
The vulnerability exists due to the REST API returning sensitive user fields, including session tokens, when processing authorized read requests. A low-privileged remote attacker can retrieve these tokens and construct session cookies to authenticate as another user without knowing their password or requiring victim interaction.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.1