CVE-2026-16772
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Akaunting versions <= 3.1.21, low-privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the UpdateUser job, which processes user-supplied role assignments via an unconditional roles()->sync() call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission-gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0.
Risk Assessment
The risk includes privilege escalation to administrator level by regular users, potentially leading to full compromise of the Akaunting system.
Recommendation
Update Akaunting to version 3.2.0 or later immediately and review user accounts for unauthorized role changes.
Other vulnerabilities in Akaunting
See all- CVE-2022-51019High
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.
- CVE-2026-19198High
Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.
- CVE-2026-71251Medium
In Akaunting, the shared download route (uploads/{id}/download) does not verify that the requested file belongs to the logged-in customer's company. An authenticated portal customer can download other companies' uploaded files by guessing or enumerating media IDs.
- CVE-2026-11994Medium
Akaunting version 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.
- CVE-2026-11943Medium
Akaunting version 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their profile name.
- CVE-2026-11942Medium
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
- CVE-2026-8193Medium
A weakness has been identified in Akaunting 3.1.21. The component Invoice PDF Rendering in file config/dompdf.php is affected. Manipulation can lead to server-side request forgery (SSRF). The attack may be launched remotely. The exploit has been made public and could be used. The vendor did not respond.
- CVE-2026-5568Low
A cross-site scripting vulnerability was found in Akaunting up to version 3.1.21 in the Invoice/Billing component via the notes argument. Remote attack is possible. Exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0, commit 80ef6d3b154a.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS