{"id":"CVE-2026-118855","kind":"vulnerability","aliases":["CVE-2026-118855"],"related":[],"title":"Akaunting: invoice import lets one user run scripts in another user's session","description":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.","summary":"Akaunting 3.3.0 accepts any string as invoice status when invoices are imported from XLSX and prints it unescaped in a hidden input on the invoice edit form. A user with invoice-creation rights (Manager role in the PoC) can run script in the session of an administrator who opens that invoice. A public PoC is in the discoverer's advisory; no exploitation reported.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"akaunting","fixed":[],"affected":"3.3.0","ecosystem":"composer"}],"ecosystems":[],"tags":["akaunting","invoicing","package","php","self-hosted","stored-xss"],"not_affected_if":["no-invoice-import-permission","single-user-install","versions-other-than-3.3.0"],"how_to_check":"Check the installed version (admin footer or composer.json / version file): 3.3.0 is the only affected version named. Look for documents with a status other than draft, paid, partial, sent, received, viewed, cancelled, e.g. SQL: SELECT id, document_number, status FROM documents WHERE status NOT IN ('draft','paid','partial','sent','received','viewed','cancelled'); (also check your installed version's list of statuses, 3.3.1 added accrued/outstanding status groups). Also check who holds the create-sales-invoices permission (Manager role).","fix":"No fixed version confirmed. Akaunting 3.3.1 (released 11 Nov 2026) release notes do not list this issue; check the 3.3.1 code for hidden.blade.php using {{ }} and the status allowlist in Document.php before relying on it. Until then: restrict invoice import to trusted users, do not open edit pages of imported invoices from untrusted sources, delete documents with unsupported status values.","status":"open","published_at":"2026-11-12T08:16:39+00:00","first_seen_at":"2026-11-12T08:37:14+00:00","triaged_at":"2026-11-12T08:38:33+00:00","updated_at":"2026-11-12T08:39:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T08:38:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Akaunting: invoice import lets one user run scripts in another user's session","impact":"medium","summary":"Akaunting 3.3.0 stores HTML imported in an invoice status field and renders it unescaped on the invoice edit form. When another logged-in user opens that invoice, the attacker's markup runs in the victim's Akaunting session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["akaunting","self-hosted","invoicing","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in another staff member's session, acting as them","analyst_note":"Confirm the fixed version and any vendor advisory for Akaunting 3.3.0 at the NVD entry or the Akaunting repository.","how_to_check":"- Check the installed Akaunting version in the app's `composer.json` or admin footer; `3.3.0` is the affected version named in the sources.\n- Review invoice import logs and imported invoices for HTML or script tags in the status field.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-install","no-invoice-import-permission","versions-other-than-3.3.0"],"who_is_affected":"Teams that run Akaunting 3.3.0 and let more than one authenticated user create or import invoices are exposed. An attacker needs an account with invoice-creation permission, and the payload fires when a different user opens the invoice edit form. Installations with a single user, or where only trusted staff can import invoices, carry much less risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4583,"output_tokens":599,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory for Akaunting 3.3.0 at the NVD entry or the Akaunting repository.","search":"'-118855':16A,19A '-2026':15A,18A '3.3.0':32B,96C 'accept':33B 'administr':78B 'advisori':91B 'akaunt':1A,21B,31B,95C,134C,158C 'akaunting':20A 'allow':147C 'anoth':10A,125C 'attack':149C 'attacker-control':148C 'authent':109C,126C 'blade':145C 'contain':97C 'control':150C 'creation':63B,114C 'cross':101C 'cross-sit':100C 'cve':14A,17A 'discover':89B 'edit':56B,132C 'execut':153C 'exploit':93B 'field':123C 'form':57B,133C 'hidden':51B,141C 'host':27B 'html':118C 'import':3A,42B,107C,117C 'input':52B,142C 'invoic':2A,22B,37B,40B,55B,62B,82B,106C,113C,121C,130C 'invoice-cr':61B,112C 'let':4A 'manag':65B 'markup':151C 'one':5A 'open':80B,128C 'origin':159C 'output':146C 'packag':23B 'permiss':115C 'php':24B 'poc':69B,85B 'print':46B 'public':84B 'raw':144C 'render':135C 'report':94B 'right':64B 'role':66B 'run':7A,71B 'script':8A,72B,103C 'self':26B 'self-host':25B 'session':13A,75B 'site':102C 'status':38B,122C,138C 'store':29B,99C,137C 'stored-xss':28B 'string':35B 'unescap':48B 'user':6A,11A,59B,110C,127C 'victim':156C 'vulner':104C 'xlsx':44B 'xss':30B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Akaunting 3.3.0 and let more than one authenticated user create or import invoices are exposed. An attacker needs an account with invoice-creation permission, and the payload fires when a different user opens the invoice edit form. Installations with a single user, or where only trusted staff can import invoices, carry much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["akaunting"],"ptokens":["akaunting"],"labels":["akaunting","high","invoicing","package","php","selfhosted","storedxss"],"campaign_type":null,"search_a":"'-118855':16A,19A '-2026':15A,18A 'akaunt':1A 'akaunting':20A 'anoth':10A 'cve':14A,17A 'import':3A 'invoic':2A 'let':4A 'one':5A 'run':7A 'script':8A 'session':13A 'user':6A,11A","search_b":"'3.3.0':32B 'accept':33B 'administr':78B 'advisori':91B 'akaunt':21B,31B 'creation':63B 'discover':89B 'edit':56B 'exploit':93B 'form':57B 'hidden':51B 'host':27B 'import':42B 'input':52B 'invoic':22B,37B,40B,55B,62B,82B 'invoice-cr':61B 'manag':65B 'open':80B 'packag':23B 'php':24B 'poc':69B,85B 'print':46B 'public':84B 'report':94B 'right':64B 'role':66B 'run':71B 'script':72B 'self':26B 'self-host':25B 'session':75B 'status':38B 'store':29B 'stored-xss':28B 'string':35B 'unescap':48B 'user':59B 'xlsx':44B 'xss':30B","search_c":"'3.3.0':96C 'akaunt':95C,134C,158C 'allow':147C 'anoth':125C 'attack':149C 'attacker-control':148C 'authent':109C,126C 'blade':145C 'contain':97C 'control':150C 'creation':114C 'cross':101C 'cross-sit':100C 'edit':132C 'execut':153C 'field':123C 'form':133C 'hidden':141C 'html':118C 'import':107C,117C 'input':142C 'invoic':106C,113C,121C,130C 'invoice-cr':112C 'markup':151C 'open':128C 'origin':159C 'output':146C 'permiss':115C 'raw':144C 'render':135C 'script':103C 'site':102C 'status':122C,138C 'store':99C,137C 'user':110C,127C 'victim':156C 'vulner':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"help@fluidattacks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118855","severity":null,"published_at":"2026-11-12T08:16:39+00:00","modified_at":"2026-11-12T08:16:39+00:00","first_seen_at":"2026-11-12T08:37:14+00:00","fetched_at":"2026-11-12T08:37:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118855:3719","url":"https://fluidattacks.com/advisories/sabbath","severity":null,"published_at":"2026-11-12T08:39:37+00:00","modified_at":"2026-11-12T08:39:37+00:00","first_seen_at":"2026-11-12T08:39:37+00:00","fetched_at":"2026-11-12T08:39:37+00:00","note":"Read Fluid Attacks advisory (CNA, 'Sabbath') with PoC; root cause: status validated only required|string, hidden input rendered with raw {!! !!}. Akaunting 3.3.1 release notes (11 Nov) do not mention this fix; no vendor advisory found, fix unknown. Not verified: sources are the discoverer's, not the maintainer's.","cites":["https://fluidattacks.com/advisories/sabbath","https://github.com/akaunting/akaunting/releases"]}],"documents":[{"id":133315,"url":"https://fluidattacks.com/advisories/sabbath","title":"Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status (Fluid Attacks)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":122939,"url":"https://github.com/akaunting/akaunting/releases","title":"Akaunting releases (3.3.1, 11 Nov 2026)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}