CVE-2026-105325 · Other
NO FIX YET · SEE WHAT TO DO
A missing permission check in the accounting module lets a user who only holds the ACCOUNTING_VIEW permission update or create PaymentApplication records. The sources do not name the product, so an attacker gets write access to payment records they should only be able to read.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any deployment running a version before 24.09.08 where users hold ACCOUNTING_VIEW rights. The sources do not name the product, so the team must confirm whether its accounting system is the affected one. Installations that restrict accounting roles to users who need write access are less exposed, but the sources do not confirm this.
Not affected if patched-version
Who cares accounting, payments
Unknown from the sources.
24.09.08 or later, per the NVD descriptionMissing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentApplication.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.