CVE-2026-11942
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious code, potentially leading to data theft or session hijacking. This poses a significant threat to the application's security and user data.
Recommendation
It is recommended to upgrade to the latest version of Akaunting to mitigate this vulnerability. Additionally, implementing input validation and sanitization can help minimize the risk of XSS attacks.
Other vulnerabilities in Akaunting 3.1.21
See all- CVE-2026-19198High
Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.
- CVE-2026-16772High
In Akaunting versions <= 3.1.21, low-privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission-gated and are not affected by this issue.
- CVE-2026-71251Medium
In Akaunting, the shared download route (uploads/{id}/download) does not verify that the requested file belongs to the logged-in customer's company. An authenticated portal customer can download other companies' uploaded files by guessing or enumerating media IDs.
- CVE-2026-11994Medium
Akaunting version 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.
- CVE-2026-11943Medium
Akaunting version 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their profile name.
- CVE-2026-8193Medium
A weakness has been identified in Akaunting 3.1.21. The component Invoice PDF Rendering in file config/dompdf.php is affected. Manipulation can lead to server-side request forgery (SSRF). The attack may be launched remotely. The exploit has been made public and could be used. The vendor did not respond.
- CVE-2026-5568Low
A cross-site scripting vulnerability was found in Akaunting up to version 3.1.21 in the Invoice/Billing component via the notes argument. Remote attack is possible. Exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.