---
id: "CVE-2026-118855"
page: "https://infrastack.ai/live/CVE-2026-118855"
kind: "vulnerability"
aliases: ["CVE-2026-118855"]
title: "Akaunting: invoice import lets one user run scripts in another user's session"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "akaunting", "fixed": [], "affected": "3.3.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["akaunting", "invoicing", "package", "php", "self-hosted", "stored-xss"]
not_affected_if: ["no-invoice-import-permission", "single-user-install", "versions-other-than-3.3.0"]
published_at: "2026-11-12T08:16:39+00:00"
first_seen_at: "2026-11-12T08:37:14+00:00"
updated_at: "2026-11-12T08:39:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118855", "first_seen_at": "2026-11-12T08:37:14+00:00"}, {"source": "analyst", "url": "https://fluidattacks.com/advisories/sabbath", "first_seen_at": "2026-11-12T08:39:37+00:00", "cites": ["https://fluidattacks.com/advisories/sabbath", "https://github.com/akaunting/akaunting/releases"]}]
exploit_sources: []
---

# Akaunting: invoice import lets one user run scripts in another user's session

Link for people: https://infrastack.ai/live/CVE-2026-118855 (this .md is for agents)

Akaunting 3.3.0 accepts any string as invoice status when invoices are imported from XLSX and prints it unescaped in a hidden input on the invoice edit form. A user with invoice-creation rights (Manager role in the PoC) can run script in the session of an administrator who opens that invoice. A public PoC is in the discoverer's advisory; no exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:akaunting affected 3.3.0 fixed no fixed version listed

## How to check

Check the installed version (admin footer or composer.json / version file): 3.3.0 is the only affected version named. Look for documents with a status other than draft, paid, partial, sent, received, viewed, cancelled, e.g. SQL: SELECT id, document_number, status FROM documents WHERE status NOT IN ('draft','paid','partial','sent','received','viewed','cancelled'); (also check your installed version's list of statuses, 3.3.1 added accrued/outstanding status groups). Also check who holds the create-sales-invoices permission (Manager role).

## Fix

No fixed version confirmed. Akaunting 3.3.1 (released 11 Nov 2026) release notes do not list this issue; check the 3.3.1 code for hidden.blade.php using {{ }} and the status allowlist in Document.php before relying on it. Until then: restrict invoice import to trusted users, do not open edit pages of imported invoices from untrusted sources, delete documents with unsupported status values.

## Timeline

- 2026-11-12T08:37:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118855
- 2026-11-12T08:39:37+00:00 analyst https://fluidattacks.com/advisories/sabbath — Read Fluid Attacks advisory (CNA, 'Sabbath') with PoC; root cause: status validated only required|string, hidden input rendered with raw {!! !!}. Akaunting 3.3.1 release notes (11 Nov) do not mention this fix; no vendor advisory found, fix unknown. Not verified: sources are the discoverer's, not the maintainer's.

## Documents

- [advisory] Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status (Fluid Attacks) https://fluidattacks.com/advisories/sabbath
- [mentions] Akaunting releases (3.3.1, 11 Nov 2026) https://github.com/akaunting/akaunting/releases

## From the sources

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_