Authenticated Improper Authorization in Akaunting 3.1.21

Executive Summary

CVE-2026-19198 is an improper authorization vulnerability in Akaunting version 3.1.21 that allows privilege escalation. The flaw exists in the BulkActions dispatcher, which fails to properly validate user permissions when handling certain actions. Specifically, the dispatcher only checks permissions if the requested action is a direct key in the metadata array, missing cases like internal methods (e.g., update, destroy) that aren't explicitly listed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized POST requests to the BulkActions endpoint with handles like update or destroy. Check server logs for suspicious activity from authenticated users with admin-panel access but without user-management permissions. Look for privilege escalation attempts, such as role changes or user deletions.

Useful 0 Not Useful 0

Impact Analysis

An authenticated user with admin-panel access but without user-management permissions (e.g., a Manager role) can exploit this by sending direct POST requests to the BulkActions endpoint with handles like update or destroy. This bypasses intended authorization checks, allowing actions such as changing user roles, promoting a Manager to Admin, or deleting other users. The vulnerability requires a valid session, CSRF token, and knowledge of target user IDs, but no additional user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Akaunting to version 3.2.1 or later to apply the fix. Review user roles and permissions to ensure no unauthorized privilege escalation has occurred. Monitor for any suspicious activity or unauthorized changes in user roles or data deletions.

Useful 0 Not Useful 0