Akaunting CVE-2026-11994

Exploitation requires an authenticated Akaunting session with high privileges - specifically, the permission to create or update reports within the report management workflow, as confirmed by the CVSS PR:H metric. A second condition (UI:P) requires that a victim user independently navigates to and views the report containing the injected payload; the attacker cannot force this view without social engineering. No non-default application configuration is required for the injection point to be present, as the report description field is part of the standard Akaunting report workflow. Exploitation is bounded by version 3.1.21 as stated, though adjacent versions are not ruled out given the CPE wildcard. The vulnerability has no impact on availability (VA:N/SA:N) and cannot be triggered from an unauthenticated network position.

The CVSS 4.0 base score of 4.8 (Medium) accurately captures a constrained but meaningful threat: the PR:H requirement restricts the exploitable attacker population to accounts already granted report management permissions, and UI:P means a victim must independently view the report for execution to occur. Both constraints together materially limit opportunistic exploitation. No EPSS data was present in the provided intelligence, and no CISA KEV listing exists, meaning neither widespread automated exploitation nor confirmed active targeting has been established. Real-world risk is nonetheless elevated in multi-user or enterprise Akaunting deployments where report-editing rights are distributed across roles beyond full administrators - a compromised or malicious report-editor account becomes the primary threat actor. The stored delivery mechanism is a meaningful escalation over reflected XSS because the payload persists and can silently affect multiple victims over time without further attacker interaction. The wildcard CPE (cpe:2.3:a:akaunting:akaunting:*) indicates NVD has not bounded the affected version range beyond the 3.1.21 stated in the report, so broader version exposure is possible but unconfirmed.

An attacker holding a high-privileged Akaunting account with report management rights edits or creates a report and inserts a JavaScript payload - such as a script that exfiltrates document.cookie to an attacker-controlled endpoint - into the description field. When a legitimate user, such as an accountant or administrator, opens that report during routine financial review, the stored payload executes silently in their authenticated browser session, transmitting their session token to the attacker and enabling full account takeover. No public proof-of-concept code has been identified at time of analysis, but the attack technique requires no specialized tooling beyond knowledge of basic XSS methodology.