{"id":"CVE-2026-118597","kind":"vulnerability","aliases":["CVE-2026-118597"],"related":[],"title":"Akaunting: stored XSS in invoice payment terms runs script for other users","description":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.","summary":"Akaunting 3.3.0 lets a logged-in Manager save a crafted custom invoice payment-term value. When another authorized user opens Invoice Settings for the same company, the stored value runs as JavaScript in their logged-in session.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Akaunting","fixed":[],"affected":"3.3.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["akaunting","invoicing","other","self-hosted"],"not_affected_if":["no-manager-role-users","other-versions"],"how_to_check":"- Check whether the installed Akaunting version is 3.3.0 (Settings/About or composer/version file).\n- Review custom payment terms in Invoice Settings for script-like text (quotes, <, onclick/event-handler fragments).\n- Check which users hold the Manager role; the flaw needs a Manager to plant the value.\n- Also check 3.3.1: its release notes do not list an XSS fix, so do not assume it is patched.","fix":null,"status":"open","published_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:37:44+00:00","updated_at":"2026-11-12T06:38:42+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-12T06:37:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Akaunting: stored XSS in invoice payment terms runs script for other users","impact":"medium","summary":"Akaunting 3.3.0 lets a logged-in Manager save a crafted custom invoice payment-term value. When another authorized user opens Invoice Settings for the same company, the stored value runs as JavaScript in their logged-in session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["akaunting","self-hosted","invoicing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in other users' logged-in Akaunting sessions.","analyst_note":"Confirm the fixed version and any workaround from the NVD entry or the Akaunting release notes (https://nvd.nist.gov/vuln/detail/CVE-2026-118597).","how_to_check":"- Check whether the installed Akaunting version is `3.3.0`\n- Review custom payment terms in Invoice Settings for unexpected script-like text\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","no-manager-role-users"],"who_is_affected":"Companies running Akaunting 3.3.0 where users with the Manager role can edit invoice settings. Exposure depends on whether untrusted or semi-trusted users hold that role. unknown for any further detail the sources do not give.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4589,"output_tokens":551,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any workaround from the NVD entry or the Akaunting release notes (https://nvd.nist.gov/vuln/detail/CVE-2026-118597).","search":"'-118597':15A,18A '-2026':14A,17A '3.3.0':27B,67C 'akaunt':1A,20B,26B,66C,104C 'akaunting':19A 'anoth':44B 'attack':120C 'attacker-control':119C 'authent':82C,129C 'author':45B,95C 'caus':118C 'client':112C 'client-sid':111C 'compani':53B,103C 'contain':68C 'control':121C 'craft':36B,87C 'cross':72C 'cross-sit':71C 'custom':37B,77C,88C 'cve':13A,16A 'event':115C 'event-handl':114C 'execut':124C 'express':117C 'handler':116C 'host':25B 'insert':105C 'invoic':5A,21B,38B,48B,78C,98C 'javascript':59B,122C 'let':28B 'log':31B,63B 'logged-in':30B,62B 'manag':33B,83C 'open':47B,97C 'origin':130C 'payment':6A,40B,79C,90C 'payment-term':39B,89C 'run':8A,57B 'save':34B,85C 'script':9A,74C 'self':24B 'self-host':23B 'session':65B 'set':49B,99C 'side':113C 'site':73C 'store':2A,55B,70C,107C 'term':7A,41B,80C,91C 'user':12A,46B,96C 'valu':42B,56B,92C,108C 'victim':127C 'vulner':75C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Akaunting 3.3.0 installs where more than one person has access and a Manager-role user could be untrusted or compromised. A Manager saves a crafted custom payment term; another authorized user who opens Invoice Settings for the same company runs it as script in their session. Single-user installs, or ones where every Manager is fully trusted, can mostly skip it. Fixed version: unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["akaunting"],"ptokens":["akaunting"],"labels":["akaunting","high","invoicing","other","selfhosted"],"campaign_type":null,"search_a":"'-118597':15A,18A '-2026':14A,17A 'akaunt':1A 'akaunting':19A 'cve':13A,16A 'invoic':5A 'payment':6A 'run':8A 'script':9A 'store':2A 'term':7A 'user':12A 'xss':3A","search_b":"'3.3.0':27B 'akaunt':20B,26B 'anoth':44B 'author':45B 'compani':53B 'craft':36B 'custom':37B 'host':25B 'invoic':21B,38B,48B 'javascript':59B 'let':28B 'log':31B,63B 'logged-in':30B,62B 'manag':33B 'open':47B 'payment':40B 'payment-term':39B 'run':57B 'save':34B 'self':24B 'self-host':23B 'session':65B 'set':49B 'store':55B 'term':41B 'user':46B 'valu':42B,56B","search_c":"'3.3.0':67C 'akaunt':66C,104C 'attack':120C 'attacker-control':119C 'authent':82C,129C 'author':95C 'caus':118C 'client':112C 'client-sid':111C 'compani':103C 'contain':68C 'control':121C 'craft':87C 'cross':72C 'cross-sit':71C 'custom':77C,88C 'event':115C 'event-handl':114C 'execut':124C 'express':117C 'handler':116C 'insert':105C 'invoic':78C,98C 'javascript':122C 'manag':83C 'open':97C 'origin':130C 'payment':79C,90C 'payment-term':89C 'save':85C 'script':74C 'set':99C 'side':113C 'site':73C 'store':70C,107C 'term':80C,91C 'user':96C 'valu':92C,108C 'victim':127C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"help@fluidattacks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118597","severity":null,"published_at":"2026-11-12T06:17:11+00:00","modified_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118597:3710","url":"https://github.com/akaunting/akaunting/releases","severity":null,"published_at":"2026-11-12T06:38:42+00:00","modified_at":"2026-11-12T06:38:42+00:00","first_seen_at":"2026-11-12T06:38:42+00:00","fetched_at":"2026-11-12T06:38:42+00:00","note":"No primary advisory found (NVD page not retrievable; Fluid Attacks CNA entry only via NVD). Akaunting 3.3.1 release notes (11 Nov) do not mention this XSS, so fix is unconfirmed. Nothing verified.","cites":["https://github.com/akaunting/akaunting/releases"]}],"documents":[{"id":122939,"url":"https://github.com/akaunting/akaunting/releases","title":"Akaunting releases (3.3.0, 3.3.1)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}