CVE-2026-71251 — Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the request…
Published: 2026-08-05 · CVSS: 6.5 · CVSS 3.1
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7