PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11994 Akaunting CVE debrief

CVE-2026-11994 is an authenticated stored Cross-Site Scripting (XSS) vulnerability in Akaunting version 3.1.21. The vulnerability is located in the report management workflow. An attacker with permission to create or update reports can inject arbitrary HTML or JavaScript code in the description field of a report. This stored XSS could potentially allow attackers to execute malicious scripts, impacting users who view the affected reports. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 4.8, classified as MEDIUM severity. The CVE was published on June 22, 2026, at 18:16:31 GMT and modified at 19:16:39 GMT the same day.

Vendor
Akaunting
Product
Unknown
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-22
Advisory published
2026-06-22
Advisory updated
2026-06-22

Who should care

Administrators and users of Akaunting version 3.1.21 should be aware of this vulnerability, especially those with permissions to create or update reports. Developers and security teams should prioritize patching or mitigating this vulnerability to prevent potential exploitation. Users who view reports created or updated by potentially malicious users are also at risk.

Technical summary

The CVE-2026-11994 vulnerability allows authenticated users to store arbitrary HTML/JavaScript in the description field of reports. This is a stored Cross-Site Scripting (XSS) vulnerability, which means the malicious code is stored on the server and executed when a user views the report. The vulnerability requires the attacker to have permissions to create or update reports. The CVSS:4.0 vector for this vulnerability is AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, indicating a medium severity level.

Defensive priority

Patching or mitigating this vulnerability should be a high priority for administrators of Akaunting 3.1.21. Restricting report creation and update permissions to trusted users and implementing Content Security Policy (CSP) can help mitigate the risk.

Recommended defensive actions

  • Apply the latest patch or update for Akaunting to version 3.1.22 or later.
  • Restrict report creation and update permissions to trusted users only.
  • Implement Content Security Policy (CSP) to define which sources of content are allowed to be executed within a web page.
  • Monitor report creation and updates for suspicious activity.
  • Perform regular security audits and vulnerability assessments.

Evidence notes

The CVE-2026-11994 vulnerability was identified in Akaunting version 3.1.21. The vulnerability allows authenticated users with report creation or update permissions to inject malicious HTML/JavaScript code. The CVSS score of 4.8 indicates a medium severity level. The CVE was published and modified on June 22, 2026, by the National Vulnerability Database (NVD).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11994 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11994

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11994 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11994

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.