EUVD-2026-58680
GHSA-98f2-hwvc-w247
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible self-update path requires only a standard user account (PR:L); no complexity beyond a crafted request; privilege escalation alone yields no direct availability impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the UpdateUser job, which processes user-supplied role assignments via an unconditional roles()->sync() call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue.
AnalysisAI
Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assign the administrator role, gaining full platform control. The flaw resides in the UpdateUser job, which invokes roles()->sync() on caller-supplied role IDs without verifying whether the requesting user holds authorization to assign roles - exploitable by any account holding the default update-auth-profile permission. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with the default update-auth-profile permission, which is granted to all standard registered user accounts - no elevated privileges are needed beyond basic account access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) is well-calibrated: network-reachable, low complexity, requiring only a standard user account, with high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a standard low-privileged Akaunting account crafts an HTTP request to the user profile self-update endpoint, including the administrator role ID in the roles field. The UpdateUser job processes the request and calls roles()->sync() without checking authorization, applying the admin role to the attacker's account. … |
| Remediation | Upgrade Akaunting to a version beyond 3.1.21 immediately; no specific confirmed patched release version number is present in available data at time of analysis, so verify the current release directly from the Akaunting project repository and consult the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-16772 for the confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Akaunting instances across your infrastructure and document which are running version 3.1.21 or earlier by checking Administration > Settings > System Info; flag instances processing production financial data as highest priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. Rated critical severity (CVSS 9.8), this v
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, compani
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'lo
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in pro
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering c
Cross-site scripting (XSS) in Akaunting up to version 3.1.21 allows authenticated users to inject malicious scripts via
Stored Cross-Site Scripting in Akaunting 3.1.21 allows a high-privileged authenticated user with report creation or upda
Stored cross-site scripting in Akaunting 3.1.21 allows an authenticated high-privileged user to inject arbitrary HTML an
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today