CVE-2026-71251 — Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

CVE-2026-71251

Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint PUBLISHED

Description (CNA)

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.

Affected (CNA)

Vendor / product	Versions
akaunting / akaunting	affected 0

CWE

CWE-639

References

https://github.com/akaunting/akaunting

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.