Akaunting CVE-2026-11943

Exploitation requires the attacker to hold an authenticated session with high-privilege access (PR:H per CVSS 4.0) sufficient to modify their own user profile name within Akaunting 3.1.21. The injected payload only fires when a second authenticated user passively views an invoice or bill detail page (UI:P) that includes the attacker's account in the document timeline - meaning the attacker must have interacted with at least one document that the victim will later open. Exploitation is limited by: (1) the attacker needing a pre-existing high-privileged account, ruling out unauthenticated or low-privilege attackers; (2) passive victim interaction with a specific page type (invoice or bill detail); and (3) the impact being bounded to browser-context actions rather than server-side compromise. Default Akaunting configurations are susceptible if multiple privileged users share the same instance.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained real-world risk. The vector AV:N/AC:L/AT:N/PR:H/UI:P indicates the attack is network-reachable and low-complexity, but requires a high-privileged authenticated account and passive user interaction from the victim. The PR:H barrier is the most significant limiting factor: an attacker must already control a legitimate, privileged Akaunting account to set the malicious profile name. Impact is bounded to low confidentiality and low integrity on both the vulnerable and subsequent systems (VC:L/VI:L/SC:L/SI:L), consistent with session data exposure and page content manipulation rather than remote code execution or full account takeover. No EPSS data was provided, and the absence of KEV listing and confirmed POC code further supports treating this as a moderate, non-urgent priority in most environments. The primary realistic threat is an insider or compromised privileged account leveraging this to escalate impact against other users, including administrators.

An attacker with access to a high-privileged Akaunting account navigates to their profile settings and sets their display name to a JavaScript payload such as a script tag exfiltrating the victim's session cookie to an attacker-controlled server. When any other authenticated user - such as an accountant or administrator - opens an invoice or bill detail page where the attacker's account appears in the document timeline, the stored script silently executes in the victim's browser, transmitting their session token and enabling session hijacking.