Akaunting versions 3.1.21 and earlier contain a critical vulnerability that allows authenticated users to escalate privileges and perform unauthorized actions.

This vulnerability involves missing authorization and improper privilege management (CWE-862, CWE-269). An attacker who has already authenticated to the application can leverage these flaws to gain higher-level administrative permissions.

Successful exploitation allows an authenticated user to bypass access controls, potentially leading to full administrative takeover of the application. This could result in unauthorized data access, modification of financial records, or complete system compromise. With a CVSS score of 8.1, the risk to confidentiality and integrity is significant.

Immediate Action: Update to the latest version of Akaunting as provided by the vendor.

Proactive Monitoring: Review audit logs for suspicious administrative activity or privilege changes performed by non-administrative accounts.

Compensating Controls: Implement strict role-based access control (RBAC) policies and limit the number of users with administrative privileges until the patch is applied.

Public Exploit Available: Unknown.

Given the potential for complete administrative compromise, organizations using Akaunting must prioritize upgrading to a secure version immediately. Failure to address this flaw leaves the application exposed to malicious insiders or compromised user accounts seeking to elevate their privileges.