Stored Cross-Site Scripting Vulnerability in Akaunting by Akaunting
CVE-2026-118597

7.2HIGH

Key Information:

Vendor

Akaunting

Status
Akaunting
Vendor
CVE Published:
12 November 2026

What is CVE-2026-118597?

Akaunting 3.3.0 introduces a vulnerability in the invoice payment terms feature that permits stored cross-site scripting. An authenticated Manager can manipulate custom payment-term values, which are subsequently embedded in client-side event handlers. When an authorized user accesses the Invoice Settings, the altered values execute as JavaScript within the user's session context, potentially leading to unauthorized actions or information disclosure.

Affected Version(s)

Akaunting Windows 3.3.0

References

https://fluidattacks.com/advisories/rhiannon
third-party-advisory
https://github.com/akaunting/akaunting
product
https://github.com/akaunting/akaunting/blob/3.3.0/app/Vie...
technical-description

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fluid Attacks' AI SAST Scanner
Miguel GĂłmez
.