Authorization bypass through user-controlled key in FacturaScripts - #VU163131
Published: November 9, 2026
Vulnerability identifier: #VU163131
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker with update permission on any DocFilesTrait controller to delete or reorder attachment relations belonging to other users throughout FacturaScripts.
The vulnerability exists due to missing record binding in DocFilesTrait attachment actions when processing user-supplied relation identifiers. An authenticated remote attacker can submit another record's relation identifier through an authorized controller to tamper with attachment associations without permission to modify the target record.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7