Akaunting vulnerabilities
Published CVEs affecting Akaunting products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-19198
High · 8.7
CWE-863 Aug 19, 2026
Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch
Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.
CVE-2026-11994
Medium · 4.8
CWE-79 Jun 22, 2026
Akaunting 3.1.21 - Authenticated stored XSS in report description rendering
Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.
CVE-2026-11943
Medium · 4.8
CWE-79 Jun 22, 2026
Akaunting 3.1.21 - Authenticated stored XSS in document timeline
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.
CVE-2026-11942
Medium · 4.8
CWE-79 Jun 22, 2026
Akaunting 3.1.21 - Stored XSS in delete confirmation modal
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
CVE-2024-58293
High · 8.6
CWE-1336 Dec 11, 2025
Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.