CVE-2026-129248
Deferred Deferred - Pending Action

Numeric Range Comparison Flaw in Akaunting Invoice Validation

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulDB

Description
A weakness has been identified in Akaunting up to 3.3.0. The affected element is the function calculation_to_quantity of the file helpers.php of the component Invoice Item Validation. Executing a manipulation of the argument quantity can lead to numeric range comparison without minimum check. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129248
EUVD
EUVD-2026-125894

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
n/a Akaunting 3.0
n/a Akaunting 3.1
n/a Akaunting 3.2
n/a Akaunting 3.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-118 The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
CWE-839 The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Akaunting versions up to 3.3.0. It involves the function calculation_to_quantity in helpers.php, which handles invoice item validation. The issue allows an attacker to manipulate the quantity argument, bypassing minimum value checks and potentially leading to incorrect calculations or data corruption.

Detection Guidance

This vulnerability involves a numeric range comparison issue in Akaunting versions up to 3.3.0, specifically in the calculation_to_quantity function of helpers.php. Detection requires checking for vulnerable Akaunting installations and inspecting the helpers.php file for the affected function. No specific commands are provided in the context, but manual inspection of the file path and version check is recommended.

Impact Analysis

An attacker could exploit this remotely to alter invoice quantities, leading to financial discrepancies, incorrect billing, or data integrity issues. The impact depends on system usage but may include financial loss or operational disruption.

Compliance Impact

The vulnerability allows manipulation of the quantity argument in invoice item validation, potentially leading to incorrect numeric comparisons. This could result in unauthorized financial transactions or data inaccuracies, which may impact compliance with standards like GDPR (data accuracy) or HIPAA (financial record integrity). However, specific compliance impacts are not detailed in the provided CVE data.

Mitigation Strategies

Immediately upgrade Akaunting to a version beyond 3.3.0 if an update is available. If no update is available, disable the Invoice Item Validation component or restrict access to the helpers.php file. Monitor network traffic for unusual activity related to invoice quantity manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...