Akaunting 3.1.21 Privilege Escalation via Improper Authorization (CVE-2026-19198)

Vulnerability Overview Vulnerability Name: Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch Vulnerability Type: Privilege escalation CVSS Score: 8.7 (High) CVE ID: CVE-2026-19198 Affected Versions: Akaunting 3.1.21 Fixed Version: 3.2.1 Publication Date: August 19, 2026 Discovered By: Jaime Ramírez (External Researcher) Impact Scope Affected Product: Akaunting Vulnerability Description: An improper authorization vulnerability affecting authenticated users exists in the common BulkActions dispatcher in Akaunting 3.1.21. Specific Impact: - Authenticated Manager users or accounts with permissions but lacking user management privileges can bypass the expected authorization in Akaunting 3.1.21. - Attackers can modify other users' attributes, sync arbitrary submitted role IDs, escalate attacker-controlled Manager accounts to Admin, delete other user accounts, and disable users. - Potential business impacts include: privilege escalation, unauthorized user management, loss of account availability, and unauthorized access to financial and administrative data. Remediation Fixed Version: Upgrade to Akaunting 3.2.1 or later. Remediation Measures: A fix was implemented in the method by adding a handle whitelist and modal handle permission inheritance. The patched code resolves direct action keys and modal submission handles before checking permissions. Unknown handles now return a 403-style error instead of being dynamically invoked. Proof of Concept (POC) Code Local Setup Step 1 - Confirm Attacker Starts as Manager Log in as a Manager user and verify that the account lacks user management permissions. Provided evidence shows that held the Manager role prior to exploitation. Step 2 - Escalate Manager Account via Bulk Update Handle Send a direct POST request to the BulkActions endpoint using . Step 3 - Delete Target User via Bulk Destroy Handle Send a direct POST request using . Step 4 - Confirm Impact Refresh the user page or check the database. Provided evidence shows: Prior to exploitation, had the Manager role. After exploitation, has the Admin role.

Goal Reached Thanks to every supporter — we hit 100%!

Akaunting 3.1.21 Privilege Escalation via Improper Authorization (CVE-2026-19198)