VULNERABILITY INTELLIGENCE
CVE-2026-71251
CVSS score6.5 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-08-05
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.
Weakness classification
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c: CWE-639