Akaunting CVE-2026-16772 Privilege Escalation Vulnerability Advisory and POC

Key information summary regarding the vulnerability from the webpage screenshot: --- Vulnerability Overview CVE-2026-16772: An elevation of privilege vulnerability exists in the Akaunting platform, allowing any low-privileged user to escalate themselves to administrator status by updating their own profile (self-service profile). Severity: High (CVSS v3.1 Base Score: 8.8) Vulnerability Type: Missing Authorization Check (CWE-862) + Improper Privilege Management (CWE-269) Affected Versions: Akaunting ≤ 3.1.21 Reporter: Louis Sanchez (Voke Cyber) Coordination ID: CERT/CC VU#737420 Disclosure Date: August 14, 2026 Vendor Response: No fix available at the time of disclosure; no response received from the vendor. --- Impact Scope Prerequisites: The user must possess the default permission (i.e., standard Employee, Accountant, or Manager roles). Attack Path: - The user edits their own profile page; - An additional field is added to the form submission with a value corresponding to the administrator role ID (e.g., ); - The server synchronizes this role list unconditionally without verifying whether the user has the authority to assign roles; - The user immediately gains full administrator privileges. No External Interaction Required: No phishing, timing attacks, or collaboration with other users are needed; the attack can be executed solely using the attacker's own session. --- Impact Consequences Complete access to read all financial data (invoices, bills, bank information, etc.); Ability to create, modify, or delete financial records; Ability to manage other user accounts, including creating new administrators; Ability to change system configurations (module installation, email settings, cron jobs, etc.), potentially leading to broader system compromise. --- Remediation Temporary Mitigations (No official patch currently available): 1. Review Administrator Members: Audit current accounts holding administrator privileges and remove those that should not have them. 2. Monitor Unexpected Role Changes: Alert on any profile updates that include the administrator role. 3. Limit Account Count: Reduce the total number of accounts on the instance to minimize the potential attack surface. Root Cause Fix (Code Level): In the method of , an authorization check should be added before synchronizing roles: > Core Principle: Allowing users to modify their name and email ≠ allowing them to modify their own role. Explicit authorization is required to change roles. --- POC / Exploit Code is the attacker's own user ID; is the administrator role ID (upon receiving a 200 OK response from the server, the user gains administrator privileges); No special conditions beyond a valid CSRF token are required. --- Disclosure Timeline May 2026: Vulnerability discovered via source code review; May 20, 2026: Notified vendor at ; no response received; June 4, 2026: CERT/CC coordination case opened; July 23, 2026: CVE assigned; August 14, 2026: Public disclosure; vendor still has not fixed the issue. --- > Note: This vulnerability is a logic flaw within the "self-service" feature, not a traditional injection or deserialization vulnerability. It requires analysis of business logic.

Goal Reached Thanks to every supporter — we hit 100%!

Akaunting CVE-2026-16772 Privilege Escalation Vulnerability Advisory and POC

More from this source