EUVD-2026-58680
GHSA-98f2-hwvc-w247
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or register low-privileged Akaunting account
-
DeliveryCraft profile-update HTTP request with admin role ID
-
ExploitSubmit to self-update endpoint
-
ExecutionUpdateUser job calls roles()->sync() without authorization check
-
PersistAttacker account receives full administrator role
-
ImpactAccess all financial data and platform controls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session with the default update-auth-profile permission, which is granted to all standard registered user accounts - no elevated privileges are needed beyond basic account access. No special deployment mode, non-default configuration, or specific platform is required; a default Akaunting installation on versions 3.1.21 and earlier is fully exploitable via this path. The key limiting factor is that the attacker must possess or compromise at least one legitimate user account on the target instance; unauthenticated remote exploitation is not possible (PR:L confirmed by CVSS vector). The API endpoints independently enforce authorization and are explicitly confirmed not affected by this issue. |
| Impact | The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) is well-calibrated: network-reachable, low complexity, requiring only a standard user account, with high confidentiality and integrity impact. No EPSS data was supplied, and this CVE does not appear in the CISA KEV catalog, so active exploitation is not confirmed. However, the exploitation prerequisite is minimal - any registered user, default configuration, no special deployment mode - meaning the real-world risk is disproportionately high relative to the missing KEV signal. The absence of an availability impact (A:N) reflects that the exploit yields privilege escalation rather than service disruption, but full admin access carries implicit availability risk since an attacker could modify or delete financial records. The consistent authorization enforcement on API endpoints (confirmed unaffected per description) narrows the attack surface to the self-update path specifically, which is a partial mitigating factor when evaluating blast radius. |
| Exploit ScenarioDerived | An attacker holding a standard low-privileged Akaunting account crafts an HTTP request to the user profile self-update endpoint, including the administrator role ID in the roles field. The UpdateUser job processes the request and calls roles()->sync() without checking authorization, applying the admin role to the attacker's account. The attacker immediately gains full administrator access to all accounting data, user management, and platform configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 14, 2026
Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assign the administrator role, gaining full platform control. The flaw resides in the UpdateUser job, which invokes roles()->sync() on caller-supplied role IDs without verifying whether the requesting user holds authorization to assign roles - exploitable by any account holding the default update-auth-profile permission. No public exploit has been confirmed at time of analysis, but the low exploitation barrier (authenticated, no special config) and full admin impact make this a high-priority remediation target.
RemediationAI
Upgrade Akaunting to a version beyond 3.1.21 immediately; no specific confirmed patched release version number is present in available data at time of analysis, so verify the current release directly from the Akaunting project repository and consult the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-16772 for the confirmed fix version. If immediate patching is not feasible, restrict account self-registration and audit all existing user accounts for unexpected administrator role assignments, as the exploit requires an authenticated session - reducing the pool of valid user accounts directly reduces exploitable surface. Temporarily disabling or restricting the user profile self-update endpoint is a compensating control, though it will block legitimate profile changes. The API endpoints are confirmed unaffected and do not require separate mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Akaunting is an open-source web-based accounting platform (CPE: cpe:2.3:a:akaunting:akaunting). The vulnerability exists in the UpdateUser server-side job that handles user profile self-update requests. The job calls roles()->sync() with attacker-controlled role identifiers without performing an authorization boundary check to confirm the caller is permitted to assign roles. This is a textbook instance of CWE-269 (Improper Privilege Management): the application correctly enforces role-assignment authorization on the API endpoints, but the self-update code path lacks equivalent controls, creating an inconsistent trust boundary. Because the update-auth-profile permission is standard for all registered users, the exploitable surface is every active user account on a vulnerable installation.
Know when Akaunting gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible self-update path requires only a standard user account (PR:L); no complexity beyond a crafted request; privilege escalation alone yields no direct availability impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the UpdateUser job, which processes user-supplied role assignments via an unconditional roles()->sync() call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue.
Executive ViewAI
Akaunting versions 3.1.21 and earlier contain a privilege escalation vulnerability that allows any authenticated user with standard platform access to self-assign administrator privileges and seize full control of the accounting system, exposing financial data, transaction integrity, and organizational configurations. Organizations running vulnerable Akaunting deployments face immediate risk of unauthorized access and potential financial fraud or data manipulation. Rapid inventory and containment measures are critical pending remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict user management and role assignment functionality to a small group of verified senior administrators; (2) disable the UpdateUser job if operationally feasible; (3) implement multi-factor authentication for all administrative accounts; (4) place Akaunting instances behind network controls limiting access to specified IP ranges only; (5) establish daily monitoring and alerting on all user role assignment events to detect unauthorized privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. Rated critical severity (CVSS 9.8), this v
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, compani
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'lo
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in pro
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering c
Cross-site scripting (XSS) in Akaunting up to version 3.1.21 allows authenticated users to inject malicious scripts via
Stored Cross-Site Scripting in Akaunting 3.1.21 allows a high-privileged authenticated user with report creation or upda
Stored cross-site scripting in Akaunting 3.1.21 allows an authenticated high-privileged user to inject arbitrary HTML an
Exploit-DB