CVE-2026-71251: Akaunting Auth Bypass Vulnerability

CVE-2026-71251 Overview

CVE-2026-71251 is an Insecure Direct Object Reference (IDOR) vulnerability in Akaunting, an open-source online accounting platform. The flaw resides in the shared download route handled by app/Http/Controllers/Common/Uploads.php::download(), reachable at uploads/{id}/download. The route sits behind generic authentication middleware but performs no tenant-scoped ownership check on the requested Media record. Any authenticated portal customer can enumerate or guess media IDs to download files belonging to any other company on the same instance. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated portal customers can download arbitrary uploaded files across tenant boundaries, exposing invoices, contracts, and other confidential business documents.

Affected Products

Akaunting (self-hosted and portal deployments) prior to commit 80ef6d3
Multi-tenant Akaunting installations exposing the customer portal
Any Akaunting instance using the shared uploads/{id}/download route

Discovery Timeline

2026-07-12 - Fix committed to the Akaunting repository (80ef6d3)
2026-08-05 - CVE-2026-71251 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71251

Vulnerability Analysis

Akaunting exposes a portal-facing download endpoint at uploads/{id}/download. The controller method download() in app/Http/Controllers/Common/Uploads.php accepts a numeric media identifier and returns the corresponding stored file. The route protects itself with generic authentication middleware but does not verify that the fetched Media record belongs to the requesting portal customer's own company or contact. Because media IDs are sequential integers, an authenticated customer can trivially iterate id values and retrieve files uploaded by unrelated tenants. Exposed files typically include invoices, bills, receipts, and contract attachments containing financial and personal data.

Root Cause

The root cause is missing tenant-scoped authorization on a direct object reference. The controller trusted the URL-supplied media ID and used it verbatim to load the file. No comparison was made between the media's parent record contact_id and the authenticated user's own contact. This pattern maps directly to [CWE-639]. The fix in commit 80ef6d3 added an explicit ownership check comparing the media's parent record contact_id against the requesting user's contact before returning the file.

Attack Vector

Exploitation requires only a valid low-privilege portal customer account on the target Akaunting instance. The attacker authenticates, then issues sequential HTTP GET requests to uploads/{id}/download incrementing the id parameter. Successful responses return files belonging to arbitrary other companies. The attack is network-reachable, requires low complexity, and needs no user interaction. See the Akaunting repository for source references and the fix commit.

Detection Methods for CVE-2026-71251

Indicators of Compromise

Sequential or rapidly incrementing requests to uploads/{id}/download from a single authenticated session
Portal customer accounts downloading media IDs outside their typical historical range
HTTP 200 responses to uploads/{id}/download for media IDs the requesting contact has never created or been shared with
Unusual outbound file transfer volume tied to a single portal user session

Detection Strategies

Correlate web server access logs with application-level media ownership records to flag cross-tenant reads
Alert on any portal user whose downloads span multiple company_id or contact_id scopes within a short window
Baseline normal download counts per portal customer and alert on statistical outliers

Monitoring Recommendations

Enable verbose logging on the Common/Uploads controller including authenticated user ID and target media ID
Forward Akaunting web and application logs to a centralized SIEM for retention and correlation
Review portal customer activity for enumeration patterns against the uploads/{id}/download endpoint

How to Mitigate CVE-2026-71251

Immediate Actions Required

Update Akaunting to a build that includes commit 80ef6d3 from 2026-07-12 or later
Audit web server logs for prior enumeration of uploads/{id}/download and identify affected tenants
Rotate or revoke any credentials, API tokens, or contracts that may have been disclosed through exposed uploads
Notify impacted portal customers if evidence of cross-tenant access is discovered

Patch Information

The vulnerability is fixed in Akaunting commit 80ef6d3 (2026-07-12). The patch adds an explicit ownership check that compares the media's parent record contact_id against the requesting user's own contact before serving the file. Deployments should pull the latest release from the Akaunting GitHub repository and redeploy.

Workarounds

Restrict portal access to trusted customers only until the patch is applied
Place a reverse proxy rule in front of uploads/{id}/download that enforces per-tenant rate limiting to slow enumeration
Temporarily disable the customer portal on multi-tenant instances if immediate patching is not feasible

bash

# Update Akaunting to include the fix commit 80ef6d3
cd /var/www/akaunting
git fetch origin
git checkout master
git pull origin master
php artisan migrate --force
php artisan cache:clear