CVE-2026-71251: Akaunting: Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download(), reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs. Fixed in commit 80ef6d3 (2026-07-12), which added an explicit ownership check comparing the media's parent record contactid against the requesting user's own contact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Akauntingto a version that resolves this vulnerability.Patch 80ef6d3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71251?
The severity of CVE-2026-71251 is medium with a score of 6.5.
How does CVE-2026-71251 affect customer data security?
CVE-2026-71251 allows unauthorized access to media files belonging to other companies due to insufficient verification on the download endpoint.
How can I mitigate CVE-2026-71251 in my Akaunting installation?
To mitigate CVE-2026-71251, ensure that access controls are properly enforced to restrict media downloads to the correct company.
When was CVE-2026-71251 published?
CVE-2026-71251 was published on August 5, 2026.
What is the nature of the vulnerability in CVE-2026-71251?
CVE-2026-71251 is an insecure direct object reference (IDOR) vulnerability that allows unauthorized media access through the customer portal.