CVE-2026-16772

CVE-2026-16772 (Akaunting) affects versions sync() call that does not verify authorization to manage roles. Affected users need only the default update-auth-profile permission to access the self-update path and grant themselves administrator privileges. The API endpoints are properly permission-g...

EUVD-2026-58680

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...

PT-2026-72040

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...