Authenticated Users Privilege Escalation in Akaunting

Executive Summary

CVE-2026-16772 is a privilege escalation flaw in Akaunting versions 3.1.21 or earlier. Low-privileged authenticated users can exploit the UpdateUser job to assign themselves the admin role by modifying their own account. The issue occurs because the application uses an unconditional roles()->sync() call without verifying if the user is authorized to change roles. Only the default update-auth-profile permission is required to access the self-update feature.

Useful 0 Not Useful 0

Detection Guidance

Check Akaunting user roles for unexpected admin assignments by reviewing the `users` table in the database for entries where the role ID is set to admin. Inspect web server logs for POST requests to the profile update endpoint containing role modification payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker with basic user permissions could escalate to admin status, gaining full control over the system. This includes access to sensitive financial data, ability to manage other users, and control over system settings. The attack requires only a simple POST request to the profile update endpoint with no additional conditions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Unrestricted admin access may result in data breaches, improper data handling, and failure to maintain audit trails, potentially leading to legal penalties and loss of certification.

Useful 0 Not Useful 0

Mitigation Strategies

Remove admin privileges from non-admin users immediately. Disable self-service profile updates if possible. Monitor for unauthorized role changes and restrict access to the profile update endpoint until a patch is available.

Useful 0 Not Useful 0