CVE-2026-71251

Name of the Vulnerable Software and Affected Versions Akaunting (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists in the shared download route. The download() function within app/Http/Controllers/Common/Uploads.php, accessible via the endpoint uploads/{id}/download, fails to verify if the requested Media record belongs to the requesting portal customer's company. This allows any authenticated portal customer to download files uploaded by other companies by guessing or enumerating the id variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.