EUVD-2026-38290
GHSA-3777-v3gr-3jr3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges (PR:H) required to inject; victim must view report (UI:R); script execution crosses to victim browser, changing scope (S:C); limited C/I impact, no availability impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.
AnalysisAI
Stored Cross-Site Scripting in Akaunting 3.1.21 allows a high-privileged authenticated user with report creation or update permissions to persist arbitrary HTML/JavaScript in the description field of the report management workflow. Any user - including administrators - who subsequently views the poisoned report will have the malicious script execute in their browser session, enabling session token theft, credential harvesting, or unauthorized UI actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the stored nature of the payload amplifies impact over reflected XSS variants in shared-user deployments.
Technical ContextAI
Akaunting is an open-source, PHP-based accounting and finance management web application (cpe:2.3:a:akaunting:akaunting). The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant: user-supplied input in the report description field is persisted to the server without sufficient sanitization or output encoding, and is later rendered directly into the browser DOM for any viewer. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) confirms the attack surface is network-accessible, requires no special attack conditions, demands high-privilege credentials, and triggers upon passive victim page view. Subsequent-system impact (SC:L/SI:L) reflects the classic stored XSS scope change where script execution crosses from the server into arbitrary victim browser contexts.
RemediationAI
No vendor-released patched version was identified in the provided intelligence at time of analysis; patch status should be verified directly against the Akaunting GitHub repository at https://github.com/akaunting/akaunting and the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/believer. As an immediate compensating control, restrict the report creation and update permissions in Akaunting's role management to the smallest set of explicitly trusted accounts, reducing the population of principals capable of injecting stored payloads - note this may impact reporting workflows for teams accustomed to broader access. Deploying a strict Content Security Policy (CSP) header on the Akaunting web server (e.g., disallowing inline scripts via script-src 'self') can significantly reduce the exploitability of stored XSS by blocking inline script execution; this may require testing against Akaunting's own JavaScript dependencies to avoid breaking legitimate functionality. A WAF rule targeting HTML or script-tag patterns in the report description POST parameter provides an additional detection and blocking layer but risks false positives on legitimate rich-text content and should be deployed in detection-only mode initially.
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. Rated critical severity (CVSS 9.8), this v
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, compani
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'lo
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in pro
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform
Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assig
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering c
Cross-site scripting (XSS) in Akaunting up to version 3.1.21 allows authenticated users to inject malicious scripts via
Stored cross-site scripting in Akaunting 3.1.21 allows an authenticated high-privileged user to inject arbitrary HTML an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today