Akaunting 3.1.21 Authenticated Stored XSS via Report Description (CVE-2026-11944)

Vulnerability Overview Vulnerability Name: Akaunting 3.1.21 - Authenticated Stored XSS in Report Description Rendering Vulnerability Type: Stored Cross-Site Scripting (XSS) CVSS Score: 4.8 (Medium) CVE ID: CVE-2026-11944 Discoverer: Oscar Naveda (Fluid Attacks AI SAST Scanner) Affected Scope Affected Product: Akaunting Affected Version: 3.1.21 Remotely Exploitable: Yes Vulnerability Description: Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the report management process. Users with permissions to create or update reports can store arbitrary HTML/JavaScript in the report description field. The stored values are rendered without output encoding in two administrative contexts: - The report editing form, where the value is inserted into a - The report index page, where the value is directly printed in the report card description An attacker can use a payload that closes the context, such as , and execute JavaScript when another authenticated user opens the affected report editing page. The same stored value is rendered as raw HTML on the report index page. Remediation Current Status: No patch is currently available Recommendation: Wait for an official fix to be released POC Code Step 1 - Create a Report with a Malicious Description 1. Log in to Akaunting as a user allowed to create reports, e.g., . 2. Navigate to . 3. Click "New Report". 4. Fill in the form with a valid name, e.g., Report XSS Evidence. 5. Select any available report type, e.g., Income Summary. 6. Set the report description to: . 7. Save the report. Step 2 - Trigger Payload from the Report Editing Page 1. Return to the report list. 2. Open the created report in edit mode. 3. The stored description value is loaded into the shared textarea component. 4. The browser parses the injected as the end of the element, creating the injected , and executes the handler. Expected Result: is executed within the authenticated Akaunting context. Inspecting the DOM shows output equivalent to: . Step 3 - Trigger Payload from the Report Index Page 1. Store a report description containing executable HTML, e.g., . 2. Navigate to . Expected Result: The report index page prints the report description via . The injected image element is parsed, and its handler is executed. Evidence Video Evidence: Video containing the exploitation Static Evidence: Screenshots containing the exploitation System Information Product: Akaunting Version: 3.1.21 Operating System: Any References GitHub Repository: https://github.com/akaunting/akaunting Security: https://github.com/akaunting/akaunting/security Timeline June 11, 2026: Vulnerability discovered June 11, 2026: Vendor contacted June 22, 2026: Public disclosure Credits Discoverer: Oscar Naveda (Fluid Attacks) Tool: AI SAST Scanner

Goal Reached Thanks to every supporter — we hit 100%!

Akaunting 3.1.21 Authenticated Stored XSS via Report Description (CVE-2026-11944)

More from this source