Akaunting vulnerabilities
We track 9 vulnerabilities in Akaunting products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest Akaunting vulnerabilities
- 7.0 High severity
Akaunting: Improper Neutralization of Input During Web Page Generation
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recu
- 7.0 High severity
Akaunting: Improper Neutralization of Input During Web Page Generation
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akau
- 7.2 High severity
Akaunting: Improper Neutralization of Input During Web Page Generation
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts
- 7.0 High severity
Akaunting: Improper Neutralization of Input During Web Page Generation
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting
- 8.8 High severity
akaunting: Improper Neutralization of Special Elements used in an OS Command
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metachara
- 8.7 High severity
Akaunting: Incorrect Authorization
Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.
- 8.1 High severity
Akaunting: Improper Privilege Management
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes use
- 8.6 High severity
Akaunting: Improper Neutralization of Special Elements Used in a Template Engine
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor nam
- 9.8 Critical severity
Akaunting: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.