CVE-2026-19198

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

In Akaunting versions <= 3.1.21, low-privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the UpdateUser job, which processes user-supplied role assignments via an unconditional roles()->sync() call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission-gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0.

In Akaunting, the shared download route (uploads/{id}/download) does not verify that the requested file belongs to the logged-in customer's company. An authenticated portal customer can download other companies' uploaded files by guessing or enumerating media IDs.

Akaunting version 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.

Akaunting version 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their profile name.

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.

A weakness has been identified in Akaunting 3.1.21. The component Invoice PDF Rendering in file config/dompdf.php is affected. Manipulation can lead to server-side request forgery (SSRF). The attack may be launched remotely. The exploit has been made public and could be used. The vendor did not respond.

A cross-site scripting vulnerability was found in Akaunting up to version 3.1.21 in the Invoice/Billing component via the notes argument. Remote attack is possible. Exploit is publicly available. The vendor did not respond.