EUVD-2026-38260
GHSA-rqfr-jhc5-r4q9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS with scope change; PR:H reflects required record-modification permissions; UI:R for victim interaction; no availability impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
AnalysisAI
Stored cross-site scripting in Akaunting 3.1.21 allows an authenticated user with record creation or modification privileges to embed malicious HTML/JavaScript into record name fields (such as Items), which subsequently executes in any other user's browser session when the reusable delete confirmation dialog renders that name unsanitized. The vulnerability is confirmed by Fluid Attacks security research and affects the shared delete confirmation component across multiple record types. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 score of 4.8 reflects the authentication barrier and required victim interaction as meaningful limiting factors.
Technical ContextAI
Akaunting is an open-source web-based accounting application (cpe:2.3:a:akaunting:akaunting:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input in record name fields is persisted to the database and later reflected into a reusable delete confirmation UI component without adequate output encoding or sanitization. Because the delete confirmation flow is a shared, reusable component across multiple record types (Items and potentially others), the injection point is not isolated to a single feature but propagates wherever that component is invoked. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N confirms the attack is network-delivered with no special attack requirements (AT:N), but gated by high-privilege access and passive victim interaction.
RemediationAI
No specific vendor-released patched version was identified in the available data - the upstream fix version is not independently confirmed. Organizations running Akaunting 3.1.21 should monitor the project repository at https://github.com/akaunting/akaunting for a security release and apply it promptly when available. As a compensating control, restrict record creation and modification permissions (particularly for the Items module and similar record types) to the minimum set of trusted users, since the vulnerability requires PR:H access to create a malicious payload. Deploying a Content Security Policy (CSP) header that disallows inline script execution ('script-src' without 'unsafe-inline') would neutralize the XSS payload at the browser level, though this may affect legitimate Akaunting UI functionality and should be tested before production deployment. Additionally, review audit logs for unexpected record name values containing HTML tags as an indicator of attempted exploitation. The Fluid Attacks advisory at https://fluidattacks.com/es/advisories/human should be checked for any updated remediation guidance.
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. Rated critical severity (CVSS 9.8), this v
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, compani
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'lo
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in pro
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform
Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assig
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering c
Cross-site scripting (XSS) in Akaunting up to version 3.1.21 allows authenticated users to inject malicious scripts via
Stored Cross-Site Scripting in Akaunting 3.1.21 allows a high-privileged authenticated user with report creation or upda
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today