CVE-2026-71251: Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Akaunting app/Http/Controllers/Common/Uploads.php::download (uploads/{id}/download)to a version that resolves this vulnerability.Patch 80ef6d3 - Configuration
Ensure the shared download endpoint app/Http/Controllers/Common/Uploads.php::download verifies that the requested Media record belongs to the requesting portal customer's own company by comparing the media's parent record contact_id to the authenticated requesting user's contact (as implemented in commit 80ef6d3).
Akaunting customer portal (uploads/{id}/download) uploads/{id}/download access control = add/require explicit media ownership verification (media.parent contact_id must match requesting user's contact_id)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71251?
The severity of CVE-2026-71251 is medium with a score of 6.5.
How does CVE-2026-71251 affect customer data security?
CVE-2026-71251 allows unauthorized access to media files belonging to other companies due to insufficient verification on the download endpoint.
How can I mitigate CVE-2026-71251 in my Akaunting installation?
To mitigate CVE-2026-71251, ensure that access controls are properly enforced to restrict media downloads to the correct company.
When was CVE-2026-71251 published?
CVE-2026-71251 was published on August 5, 2026.
What is the nature of the vulnerability in CVE-2026-71251?
CVE-2026-71251 is an insecure direct object reference (IDOR) vulnerability that allows unauthorized media access through the customer portal.