Cross-site request forgery in FacturaScripts - #VU163135
Published: November 9, 2026
Vulnerability identifier: #VU163135
CSH Severity: High
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to disable plugins or apply staged core updates in FacturaScripts, compromising code integrity and availability.
The vulnerability exists due to missing anti-CSRF validation on state-changing GET actions in the Updater controller, with authenticated cookies sent during cross-site top-level navigation. An unauthenticated attacker can lure an authenticated administrator to a crafted link that executes these actions with the victim's privileges, provided an update archive is already staged when applying updates.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.5