Authorization bypass through user-controlled key in FacturaScripts - #VU163119
Published: November 9, 2026
Vulnerability identifier: #VU163119
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker to read other users' customer records and sent-email bodies in FacturaScripts.
The vulnerability exists due to missing enforcement of the onlyownerdata ownership restriction in edit-controller export and pre-load actions when requesting another user's record. A low-privileged authenticated attacker can supply another record's identifier to retrieve its email body or, with export permission, export its contents despite the normal page denying access.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7