{"id":"CVE-2026-105325","kind":"vulnerability","aliases":["CVE-2026-105325"],"related":[],"title":"Accounting module lets view-only users create or change payment applications","description":"Missing check for  ACCOUNTING_UPDATE /  ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentApplication.\n\nAffected versions before : 24.09.08\n\nUsers are recommended to upgrade to version 24.09.08 which fixes this issue.","summary":"A missing permission check in the accounting module lets a user who only holds the ACCOUNTING_VIEW permission update or create PaymentApplication records. The sources do not name the product, so an attacker gets write access to payment records they should only be able to read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["accounting","other","payments"],"not_affected_if":["patched-version"],"how_to_check":null,"fix":"- Upgrade to version `24.09.08` or later, per the NVD description\n- Product name not given in the sources; confirm which product ships this accounting module","status":"open","published_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","triaged_at":"2026-11-05T14:40:59+00:00","updated_at":"2026-11-05T14:40:59+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-05T14:40:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to version `24.09.08` or later, per the NVD description\n- Product name not given in the sources; confirm which product ships this accounting module","reach":"network","title":"Accounting module lets view-only users create or change payment applications","impact":"medium","summary":"A missing permission check in the accounting module lets a user who only holds the ACCOUNTING_VIEW permission update or create PaymentApplication records. The sources do not name the product, so an attacker gets write access to payment records they should only be able to read.","audience":"businesses","category":"other","nicknames":[],"who_cares":["accounting","payments"],"confidence":0.4,"fix_status":"available","needs_auth":"yes","worst_case":"View-only users alter or create payment application records","analyst_note":"Identify the product behind this NVD entry (the sources give no product name) and confirm the affected version range and fixed version from the vendor advisory.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Any deployment running a version before 24.09.08 where users hold ACCOUNTING_VIEW rights. The sources do not name the product, so the team must confirm whether its accounting system is the affected one. Installations that restrict accounting roles to users who need write access are less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":4252,"output_tokens":500,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105325':15A,18A '-2026':14A,17A '24.09.08':91C,99C 'abl':65B 'access':57B 'account':1A,19B,28B,37B,71C,73C,76C,82C 'affect':88C 'allow':78C 'applic':12A 'attack':54B 'chang':10A 'check':25B,69C 'creat':8A,42B,74C 'cve':13A,16A 'fix':101C 'get':55B 'hold':35B 'issu':103C 'let':3A,30B 'miss':23B,68C 'modul':2A,29B 'name':49B 'payment':11A,21B,59B 'paymentappl':43B,87C 'permiss':24B,39B,84C 'product':51B 'read':67B 'recommend':94C 'record':44B,60B 'sourc':46B 'updat':40B,72C 'update/create':86C 'upgrad':96C 'user':7A,32B,79C,92C 'version':89C,98C 'view':5A,38B,83C 'view-on':4A 'write':56B","nicknames":[],"mitigations":[],"who_affected":"Any deployment running a version before 24.09.08 where users hold ACCOUNTING_VIEW rights. The sources do not name the product, so the team must confirm whether its accounting system is the affected one. Installations that restrict accounting roles to users who need write access are less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["accounting","other","payments","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105325","severity":null,"published_at":"2026-11-05T14:16:59+00:00","modified_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","fetched_at":"2026-11-05T14:39:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}