CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251: Authorization Bypass Through User-Controlled Key

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

PT-2026-68117

Name of the Vulnerable Software and Affected Versions Akaunting affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the shared download route. The download function within app/Http/Controllers/Common/Uploads.php, accessible via the endpoint...