FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.
Affected: Packagist: facturascripts/facturascripts
### Summary The application fails to validate the ```nick``` parameter during a ```POST``` request to the ```EditUser``` controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account (including the Administrator). This leads to Broken Access Control and potential Audit Log Corruption.
### Details The vulnerability exists in the user update logic. When a ```POST``` request is sent to ```/EditUser```, the backend processes the ```nick``` form-data parameter without checking if it matches the original value or if the user has the privilege to change a unique identifier that is intended to be immutable.
### PoC ***1.*** Log in to the dashboard as any user (e.g. admin user).
***2.*** Go to your Profile by clicking your username/avatar in the top right.
***3.*** Open Burp Suite and ensure Intercept is ON.
***5.*** Click the Save button in the UI.
***6.*** In Burp Suite, locate ```nick``` in the body:
<img width="1915" height="1013" alt="Screenshot_2026-03-04_05_26_32" src="https://github.com/user-attachments/assets/aea4e6fd-beba-4a47-96da-8b9bd9075681" />
***7.*** Change the value admin to Vulnerable (or any other string).
***8.*** Click Forward in Burp Suite.
The application will log the user out. It is possible to now log back in using the username "Vulnerable" and the original password.
### Impact An attacker can effectively sabotage the system’s audit trail, performing malicious actions and then…