FacturaScripts contains a vulnerability in its EditUser controller where the 'nick' parameter can be modified via a POST request despite being intended as immutable. This allows users to rename any account, including Administrator, bypassing UI restrictions. The flaw leads to broken access control and risks audit log corruption, enabling attackers to evade detection or impersonate others.