CVE-2021-36801highCWE-639

CVE-2021-36801: high-severity vulnerability in Akaunting

Akaunting Authentication Bypass in Company Selection

Published · Updated

Follow this CVE+ Monitor Akaunting

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 1.1%
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Akaunting · Akaunting
Related CVEs — Akaunting

In the same product, most dangerous first.

CVE-2021-36800HIGHAkaunting OS Command Injection in 'Money.php'EPSS 1.5%CVE-2021-36802MEDIUMAkaunting DoS via User-Controlled 'locale' VariableEPSS 1.0%CVE-2021-36804MEDIUMAkaunting Password Reset RelayEPSS 1.0%CVE-2021-36805MEDIUMAkaunting Invoice Footer Persistent XSSEPSS 0.6%CVE-2021-36803MEDIUMAkaunting Avatar Persistent XSSEPSS 0.6%CVE-2026-11994MEDIUMAkaunting 3.1.21 - Authenticated stored XSS in report description renderingEPSS 0.4%