CVE-2026-8193
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A weakness has been identified in Akaunting 3.1.21. The component Invoice PDF Rendering in file config/dompdf.php is affected. Manipulation can lead to server-side request forgery (SSRF). The attack may be launched remotely. The exploit has been made public and could be used. The vendor did not respond.
Risk Assessment
An attacker can use SSRF to scan internal networks, access sensitive data, or launch further attacks on internal systems.
Recommendation
It is recommended to immediately isolate the system from external networks, apply temporary WAF rules to block suspicious requests, and seek an alternative solution as the vendor did not respond.
Other vulnerabilities in Akaunting
See all- CVE-2026-19198High
Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.
- CVE-2026-16772High
In Akaunting versions <= 3.1.21, low-privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the UpdateUser job, which processes user-supplied role assignments via an unconditional roles()->sync() call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission-gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0.
- CVE-2026-71251Medium
In Akaunting, the shared download route (uploads/{id}/download) does not verify that the requested file belongs to the logged-in customer's company. An authenticated portal customer can download other companies' uploaded files by guessing or enumerating media IDs.
- CVE-2026-11994Medium
Akaunting version 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.
- CVE-2026-11943Medium
Akaunting version 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their profile name.
- CVE-2026-11942Medium
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
- CVE-2026-5568Low
A cross-site scripting vulnerability was found in Akaunting up to version 3.1.21 in the Invoice/Billing component via the notes argument. Remote attack is possible. Exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS