AKAUNTING · CVE-2026-118597 · Other
NO FIX YET
Akaunting 3.3.0 lets a logged-in Manager save a crafted custom invoice payment-term value. When another authorized user opens Invoice Settings for the same company, the stored value runs as JavaScript in their logged-in session.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Akaunting 3.3.0 installs where more than one person has access and a Manager-role user could be untrusted or compromised. A Manager saves a crafted custom payment term; another authorized user who opens Invoice Settings for the same company runs it as script in their session. Single-user installs, or ones where every Manager is fully trusted, can mostly skip it. Fixed version: unknown.
Not affected if no-manager-role-users, other-versions
Who cares akaunting, invoicing, self-hosted
Unknown from the sources.
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.