Vulnerability · Published Aug 5, 2026 · Assigned by TuranSec

CVE-2026-71251Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in akaunting from akaunting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 72.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.

Affected products (as reported)

Vendor	Product	Versions
akaunting	akaunting	0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/akaunting/akaunting third-party-advisory