CVE-2026-16772

In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0, commit 80ef6d3b154a.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://vokecyber.com/research/cve-2026-16772-akaunting-privilege-escalation
https://vokecyber.com/research/cve-2026-16772-akaunting-privilege-escalation

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-14 16:16

Updated : 2026-09-14 22:16

NVD link : CVE-2026-16772

Mitre link : CVE-2026-16772

CVE.ORG link : CVE-2026-16772

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

CWE-862

Missing Authorization

{"id": "CVE-2026-16772", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16772", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T19:47:57.430799Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Akaunting", "product": "Akaunting", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.21"}]}]}], "published": "2026-08-14T16:16:50.290", "references": [{"url": "https://vokecyber.com/research/cve-2026-16772-akaunting-privilege-escalation", "source": "cret@cert.org"}, {"url": "https://vokecyber.com/research/cve-2026-16772-akaunting-privilege-escalation", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In Akaunting versions <= 3.1.21, low\u2011privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission\u2011gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0, commit 80ef6d3b154a."}], "lastModified": "2026-09-14T22:16:57.260", "sourceIdentifier": "cret@cert.org"}