Auth bypass in Akaunting

CVE-2026-19198

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.

Vulnerability class: Broken Access Control

Affected products

Akaunting — versions 3.1.21

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

help@fluidattacks.com (third-party-advisory)
help@fluidattacks.com (product)
help@fluidattacks.com (patch)