CVE-2026-71251

6.5 mediumEPSS 0.3%

Medium (6.5). EPSS 0.3% chance of exploitation in the next 30 days.

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-08-05
Modified: 2026-08-26
Record from: the NVD, synced 2026-10-19

References

https://github.com/akaunting/akaunting

Check your stack JSON