CVE-2026-45262

«Live PoC verified 2026-04-30 against a stock FacturaScripts master at "127.0.0.1:8081". A scoped "ApiKey" with "fullaccess=0" and an "ApiAccess" row granting "allowget=1" on the "clientes" resource only no other rights, no UI session, no admin issued one "GET...