Akaunting EUVD-2026-28921

Authentication is mandatory - the CVSS vector PR:L indicates the attacker must possess valid Akaunting user credentials (low privilege level such as employee or contractor accounts). The Invoice PDF Rendering component must be enabled and accessible via the web interface. The specific manipulation method is not detailed in the description ('some unknown processing'), but dompdf.php configuration likely accepts URL or file path parameters that are passed to resource-fetching functions without validation. The application server must have network access to internal resources or cloud metadata services for the SSRF to be impactful - if the server is fully air-gapped or restricted via egress firewall rules, the vulnerability is not exploitable. Default Akaunting installations with authenticated users present is the baseline condition; no special configuration is required for the vulnerability to exist, only for it to be impactful.

The risk profile presents conflicting signals that require careful assessment. CVSS 2.1 with AV:N/AC:L/PR:L indicates network-accessible SSRF with low attack complexity but mandatory user authentication and minimal confidentiality/integrity/availability impact - standard metrics that underestimate SSRF severity because they do not account for pivot potential into internal infrastructure. The CVSS vector shows E:P (Proof of Concept Exploit), confirming publicly available weaponized code. Critically, the vendor's non-response to early disclosure is a strong indicator of abandoned software or insufficient security maintenance, meaning patches may never materialize. For organizations running Akaunting with authenticated users, this vulnerability enables lateral movement to internal services (databases, monitoring systems, cloud metadata) that could have severe downstream impact beyond the CVSS Low ratings. The authentication requirement (PR:L) significantly limits exposure to insider threats or compromised user accounts rather than public internet attacks. SSRF vulnerabilities in low-privilege contexts frequently serve as stepping stones to higher-impact breaches; real-world risk depends on network segmentation and whether internal services are accessible from the application server.

An authenticated user (employee with access to Akaunting) or an attacker with compromised user credentials navigates to the Invoice PDF Rendering feature and manipulates the dompdf.php configuration parameter to inject a URL pointing to an internal service, such as http://internal-database.local:3306 or http://169.254.169.254/latest/meta-data/ (AWS metadata). The application server, running Akaunting with access to internal networks, executes the request on behalf of the attacker and either returns error messages revealing internal service information, allows file exfiltration, or enables the attacker to interact with backend systems like databases or Kubernetes APIs that are not directly exposed to the internet.