What is CVE-2026-71251?

CVE-2026-71251 is a medium-severity vulnerability in Akaunting, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-08-05.

How severe is CVE-2026-71251?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Akaunting

CVE-2026-71251

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (10.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Akaunting — versions 0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (third-party-advisory)

Frequently asked questions

What is CVE-2026-71251?: CVE-2026-71251 is a medium-severity vulnerability in Akaunting, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-08-05.
How severe is CVE-2026-71251?: Medium severity. CVSS v3 base score is 6.5 out of 10.