Cross-site request forgery in FacturaScripts - #VU163130
Published: November 9, 2026
Vulnerability identifier: #VU163130
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to force customer or supplier master-record creation and contact modification in FacturaScripts.
The vulnerability exists due to missing CSRF token validation in EditContacto conversion actions reachable through GET requests. An unauthenticated remote attacker can lure an authenticated user with EditContacto and customer or supplier update permissions into a top-level navigation that carries authentication cookies under SameSite=Lax and silently performs the conversion.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7