CVE-2026-71251mediumCWE-639

CVE-2026-71251: medium-severity vulnerability in akaunting

Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Published · Updated

Follow this CVE+ Monitor Akaunting

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.3%
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
akaunting · akaunting
Related CVEs — akaunting

In the same product, most dangerous first.

CVE-2022-51019HIGHAkaunting before 2.1.31 OS Command Injection via app aliasEPSS 1.8%