Skip to main content

Akaunting CVE-2026-19198

| EUVDEUVD-2026-62693 HIGH
Incorrect Authorization (CWE-863)
2026-08-19 Fluid Attacks GHSA-v47h-4p48-9r9r
Authentication Bypass Akaunting
8.7
CVSS 4.0 · Vendor: Fluid Attacks
Share

Severity by source

Vendor (Fluid Attacks) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-accessible web app requiring low-privilege authentication; all three impact dimensions rated High due to unrestricted bulk access to financial records with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 19, 2026 - 19:33 vuln.today
Analysis Generated
Aug 19, 2026 - 19:33 vuln.today
CVE Published
Aug 19, 2026 - 18:58 cve.org
HIGH 8.7

DescriptionCVE.org

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.

AnalysisAI

Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform bulk operations beyond their intended access scope, potentially exposing or modifying financial records belonging to other users or organizational entities within the platform. Discovered and reported by Fluid Attacks, the flaw resides in a shared dispatcher component used across multiple modules of this open-source web-based accounting application. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low-privilege Akaunting account
Delivery
Enumerate target financial resource IDs via normal UI or API
Exploit
Craft bulk action request substituting out-of-scope resource IDs
Execution
Submit crafted request to BulkActions dispatcher
Persist
Dispatcher bypasses authorization boundary check
Impact
Access or modify unauthorized financial records
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated session with at least a low-privilege user account on the target Akaunting instance, as confirmed by the PR:L metric in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 reflects a high-severity finding with network reachability (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L), yielding high impacts across confidentiality, integrity, and availability of the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user holding a low-privilege Akaunting account - such as a standard employee or bookkeeper - crafts bulk action HTTP requests to the BulkActions dispatcher, substituting resource IDs belonging to other users, departments, or company entities for those within their own scope. Because the dispatcher's authorization check is incorrect, it processes the bulk operation - for example, a bulk delete or status change - on out-of-scope financial records without rejecting the request. …
Remediation Upgrade Akaunting to version 3.2.1, which is identified as the patched release per the vendor reference at https://github.com/akaunting/akaunting/releases/tag/3.2.1. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running Akaunting versions up to 3.1.21 and assess which host production financial data. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Akaunting

View all
CVE-2024-22836 CRITICAL POC
9.8 Feb 08

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. Rated critical severity (CVSS 9.8), this v
CVE-2021-36800 CRITICAL POC
9.1 Aug 04

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.

CVE-2021-36804 HIGH POC
8.1 Aug 04

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy
CVE-2021-36801 HIGH POC
8.1 Aug 04

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, compani
CVE-2021-36802 MEDIUM POC
6.5 Aug 04

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'lo
CVE-2021-36803 MEDIUM POC
5.4 Aug 04

Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in pro
CVE-2021-36805 MEDIUM POC
4.8 Aug 04

Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the
CVE-2026-16772 HIGH
8.1 Aug 14

Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assig
CVE-2026-8193 LOW POC
2.1 May 09

Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering c
CVE-2026-5568 LOW POC
2.0 Apr 05

Cross-site scripting (XSS) in Akaunting up to version 3.1.21 allows authenticated users to inject malicious scripts via

CVE-2026-11994 MEDIUM
4.8 Jun 22

Stored Cross-Site Scripting in Akaunting 3.1.21 allows a high-privileged authenticated user with report creation or upda
CVE-2026-11943 MEDIUM
4.8 Jun 22

Stored cross-site scripting in Akaunting 3.1.21 allows an authenticated high-privileged user to inject arbitrary HTML an

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-19198 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy