---
id: "CVE-2026-129248"
page: "https://infrastack.ai/live/CVE-2026-129248"
kind: "vulnerability"
aliases: ["CVE-2026-129248"]
title: "Akaunting: invoice quantity check lacks minimum, remote manipulation possible"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["akaunting", "package", "php", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-14T11:17:07+00:00"
first_seen_at: "2026-11-14T11:28:52+00:00"
updated_at: "2026-11-14T11:30:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129248", "first_seen_at": "2026-11-14T11:28:52+00:00"}]
exploit_sources: []
---

# Akaunting: invoice quantity check lacks minimum, remote manipulation possible

Link for people: https://infrastack.ai/live/CVE-2026-129248 (this .md is for agents)

Akaunting's helper function calculation_to_quantity in helpers.php does not check a minimum for the quantity argument, so a manipulated value can break numeric range comparison. The sources do not state what an attacker gets beyond this input-validation weakness.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Akaunting version, for example with `php artisan --version` or the version shown in the admin footer; unknown whether a fixed version exists in the sources
- Look for the Invoice Item Validation component and the function calculation_to_quantity in helpers.php

## Timeline

- 2026-11-14T11:28:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129248

## From the sources

A weakness has been identified in Akaunting up to 3.3.0. The affected element is the function calculation_to_quantity of the file helpers.php of the component Invoice Item Validation. Executing a manipulation of the argument quantity can lead to numeric range comparison without minimum check. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_