Stored Cross-Site Scripting Vulnerability in Akaunting by Akaunting
CVE-2026-119275

7HIGH

Key Information:

Vendor

Akaunting

Status
Akaunting
Vendor
CVE Published:
12 November 2026

What is CVE-2026-119275?

Akaunting version 3.3.0 is susceptible to a stored cross-site scripting (XSS) vulnerability within its XLSX invoice-import process. An authenticated user with Manager privileges can import child invoices that contain HTML in their invoice numbers, which can be linked to recurring invoices. This scenario allows malicious markup to be executed in the browser of any victim who opens the impacted recurring invoice, leading to potential exposure and exploitation of sensitive information.

Affected Version(s)

Akaunting Windows 3.3.0

References

https://fluidattacks.com/advisories/soda
third-party-advisory
https://github.com/akaunting/akaunting
product
https://github.com/akaunting/akaunting/blob/3.3.0/app/Imp...
technical-description

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fluid Attacks' AI SAST Scanner
Miguel GĂłmez
.