What is the CVSS score of EUVD-2026-53324?

EUVD-2026-53324 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Akaunting EUVD-2026-53324

| CVE-2026-71251 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-h26w-wq3x-9p76

PHP Authentication Bypass

6.5

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable route requires only portal customer authentication (PR:L); IDOR yields read-only cross-tenant file access with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 11:45 vuln.today

DescriptionCVE.org

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download(), reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs. Fixed in commit 80ef6d3 (2026-07-12), which added an explicit ownership check comparing the media's parent record contact_id against the requesting user's own contact.

AnalysisAI

Insecure Direct Object Reference in Akaunting's multi-tenant file download route exposes uploaded media records across company boundaries to any authenticated portal customer. The uploads/{id}/download endpoint in app/Http/Controllers/Common/Uploads.php applies only generic authentication middleware and fetches Media records by raw integer ID without verifying tenant ownership, enabling sequential ID enumeration to exfiltrate invoices, financial statements, and other uploaded documents belonging to unrelated companies on the same instance. No public exploit has been identified and it is not listed in CISA KEV, but the attack is trivially executable by any portal customer given the low complexity of sequential integer enumeration.

Technical ContextAI

Akaunting is a PHP-based open-source accounting web application designed for multi-tenant deployments where multiple companies share a single instance. The vulnerable component is the download() method in app/Http/Controllers/Common/Uploads.php, reachable at the route uploads/{id}/download. This route is gated only by generic authentication middleware, which confirms the user is logged in but performs no tenant-scoping assertion on the fetched Media record. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the numeric {id} path parameter is the sole mechanism determining which file is returned, and because all tenants share a single sequential ID namespace, an authenticated user from Company A can trivially construct requests for IDs allocated to Company B. The upstream fix (commit 80ef6d3, 2026-07-12) resolves this by adding an explicit ownership check that compares the media record's parent contact_id against the requesting user's own contact identity.

RemediationAI

Apply the upstream fix from commit 80ef6d3 (2026-07-12) available at https://github.com/akaunting/akaunting, which introduces an explicit ownership check comparing the media record's parent contact_id against the authenticated user's own contact identity. No packaged release version has been independently confirmed to include this fix - verify by inspecting the commit history of your deployed instance before assuming a given release is safe. As a compensating control prior to patching, administrators can disable portal customer access entirely if the file download feature is not operationally required; note this will block all portal functionality, not just file downloads. Alternatively, implement network-layer access controls to restrict which customer IP ranges can reach the uploads/ route prefix, accepting the trade-off of reduced accessibility for legitimate portal users. There are no known side effects of the upstream patch itself.