An improper validation flaw in FacturaScripts allows an authenticated user to alter the nick parameter in the EditUser controller. The nick field is intended to be immutable, and changing it can rename any account, including the administrator account. This flaw, classified as CWE-472, provides attackers with the ability to impersonate users or undermine account integrity, potentially leading to further exploitation depending on associated permissions.

The vulnerability affects NeoRazorX FacturaScripts, specifically versions 2025.92 and earlier. It applies to the open‑source accounting and invoicing application where the EditUser controller processes POST requests containing a nick form‑data parameter.

The CVSS score of 5.3 indicates moderate severity, and EPSS is not available while the vulnerability is not listed in CISA KEV. The likely attack path involves intercepting or forging a POST request to the EditUser endpoint; an authenticated user with permissions to edit users can modify the nick field. Attackers must already be logged in and have necessary edit rights, but the ability to rename an administrator account can lead to higher privilege access if the system trusts the nick field for authentication or authorization checks.