CVE-2026-16772: Akaunting vulnerability
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the UpdateUser job, which processes user-supplied role assignments via an unconditional roles()->sync() call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Akauntingto a version that resolves this vulnerability.Fixed in 3.1.21 - Compensating control
Ensure the self-update path that reaches the UpdateUser job is protected so only callers authorized to manage roles can submit/modify role assignments (do not allow users with only the default "update-auth-profile" permission to assign role IDs such as the admin role ID).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16772?
CVE-2026-16772 has a risk rating of 80, indicating it is a high-severity vulnerability.
How do I fix CVE-2026-16772?
To fix CVE-2026-16772, upgrade Akaunting to version 3.1.22 or later.
What type of vulnerability is CVE-2026-16772?
CVE-2026-16772 is a privilege escalation vulnerability affecting Akaunting.
Who is affected by CVE-2026-16772?
Low-privileged authenticated users in Akaunting versions <= 3.1.21 are affected by CVE-2026-16772.
What can an attacker do with CVE-2026-16772?
An attacker can exploit CVE-2026-16772 to assign themselves administrator privileges, leading to full control of the application.