CVE-2026-16772

Name of the Vulnerable Software and Affected Versions Akaunting versions prior to 3.1.22

Description Low-privileged authenticated users can elevate their privileges to full administrator by modifying their own account. This occurs due to a flaw in the UpdateUser job, which uses an unconditional roles()->sync() call to process role assignments without verifying if the user is authorized to manage roles. An attacker only needs the default update-auth-profile permission to access the self-update path and assign themselves the admin role ID.

Recommendations Update to a version newer than 3.1.21.