{"id":"CVE-2026-129248","kind":"vulnerability","aliases":["CVE-2026-129248"],"related":[],"title":"Akaunting: invoice quantity check lacks minimum, remote manipulation possible","description":"A weakness has been identified in Akaunting up to 3.3.0. The affected element is the function calculation_to_quantity of the file helpers.php of the component Invoice Item Validation. Executing a manipulation of the argument quantity can lead to numeric range comparison without minimum check. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Akaunting's helper function calculation_to_quantity in helpers.php does not check a minimum for the quantity argument, so a manipulated value can break numeric range comparison. The sources do not state what an attacker gets beyond this input-validation weakness.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["akaunting","package","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Akaunting version, for example with `php artisan --version` or the version shown in the admin footer; unknown whether a fixed version exists in the sources\n- Look for the Invoice Item Validation component and the function calculation_to_quantity in helpers.php","fix":null,"status":"open","published_at":"2026-11-14T11:17:07+00:00","first_seen_at":"2026-11-14T11:28:52+00:00","triaged_at":"2026-11-14T11:30:37+00:00","updated_at":"2026-11-14T11:30:37+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-14T11:30:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Akaunting: invoice quantity check lacks minimum, remote manipulation possible","impact":"low","summary":"Akaunting's helper function calculation_to_quantity in helpers.php does not check a minimum for the quantity argument, so a manipulated value can break numeric range comparison. The sources do not state what an attacker gets beyond this input-validation weakness.","audience":"businesses","category":"package","nicknames":[],"who_cares":["akaunting","self-hosted","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; input validation flaw with unclear data impact","analyst_note":"Confirm the affected Akaunting version range, whether a fix or patch exists, and the real impact of the quantity manipulation, using the NVD entry and the vendor or source repository.","how_to_check":"- Check the installed Akaunting version, for example with `php artisan --version` or the version shown in the admin footer; unknown whether a fixed version exists in the sources\n- Look for the Invoice Item Validation component and the function calculation_to_quantity in helpers.php","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running self-hosted Akaunting up to version 3.3.0 that accept invoice item input from remote users may be exposed. The sources do not describe required configuration or account access, and the vendor did not respond to the disclosure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4565,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129248':12A,15A '-2026':11A,14A '3.3.0':73C 'affect':75C 'akaunt':1A,16B,22B,70C 'argument':39B,98C 'attack':56B,110C 'beyond':58B 'break':45B 'calcul':26B,80C 'check':4A,33B,108C 'comparison':48B,105C 'compon':89C 'contact':119C 'cve':10A,13A 'disclosur':123C 'earli':120C 'element':76C 'execut':93C 'file':85C 'function':25B,79C 'get':57B 'helper':24B 'helpers.php':30B,86C 'host':21B 'identifi':68C 'input':61B 'input-valid':60B 'invoic':2A,90C 'item':91C 'lack':5A 'lead':101C 'manipul':8A,42B,95C 'may':111C 'minimum':6A,35B,107C 'numer':46B,103C 'packag':17B 'perform':113C 'php':18B 'possibl':9A 'quantiti':3A,28B,38B,82C,99C 'rang':47B,104C 'remot':7A,115C 'respond':127C 'self':20B 'self-host':19B 'sourc':50B 'state':53B 'valid':62B,92C 'valu':43B 'vendor':117C 'way':130C 'weak':63B,65C 'without':106C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted Akaunting up to version 3.3.0 that accept invoice item input from remote users may be exposed. The sources do not describe required configuration or account access, and the vendor did not respond to the disclosure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["akaunting","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-129248':12A,15A '-2026':11A,14A 'akaunt':1A 'check':4A 'cve':10A,13A 'invoic':2A 'lack':5A 'manipul':8A 'minimum':6A 'possibl':9A 'quantiti':3A 'remot':7A","search_b":"'akaunt':16B,22B 'argument':39B 'attack':56B 'beyond':58B 'break':45B 'calcul':26B 'check':33B 'comparison':48B 'function':25B 'get':57B 'helper':24B 'helpers.php':30B 'host':21B 'input':61B 'input-valid':60B 'manipul':42B 'minimum':35B 'numer':46B 'packag':17B 'php':18B 'quantiti':28B,38B 'rang':47B 'self':20B 'self-host':19B 'sourc':50B 'state':53B 'valid':62B 'valu':43B 'weak':63B","search_c":"'3.3.0':73C 'affect':75C 'akaunt':70C 'argument':98C 'attack':110C 'calcul':80C 'check':108C 'comparison':105C 'compon':89C 'contact':119C 'disclosur':123C 'earli':120C 'element':76C 'execut':93C 'file':85C 'function':79C 'helpers.php':86C 'identifi':68C 'invoic':90C 'item':91C 'lead':101C 'manipul':95C 'may':111C 'minimum':107C 'numer':103C 'perform':113C 'quantiti':82C,99C 'rang':104C 'remot':115C 'respond':127C 'valid':92C 'vendor':117C 'way':130C 'weak':65C 'without':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129248","severity":null,"published_at":"2026-11-14T11:17:07+00:00","modified_at":"2026-11-14T11:17:07+00:00","first_seen_at":"2026-11-14T11:28:52+00:00","fetched_at":"2026-11-14T11:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}