CVE-2026-129248 · Package
NO FIX YET
Akaunting's helper function calculation_to_quantity in helpers.php does not check a minimum for the quantity argument, so a manipulated value can break numeric range comparison. The sources do not state what an attacker gets beyond this input-validation weakness.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running self-hosted Akaunting up to version 3.3.0 that accept invoice item input from remote users may be exposed. The sources do not describe required configuration or account access, and the vendor did not respond to the disclosure.
Not affected if unknown
Who cares akaunting, php, self-hosted
php artisan --version or the version shown in the admin footer; unknown whether a fixed version exists in the sourcesNo fix yet, per the sources.
A weakness has been identified in Akaunting up to 3.3.0. The affected element is the function calculation_to_quantity of the file helpers.php of the component Invoice Item Validation. Executing a manipulation of the argument quantity can lead to numeric range comparison without minimum check. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.