https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T04:32:58.271833+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-71251 CVE-2026-71251 — Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint 2026-10-08T04:32:58.286355+00:00

Affected: akaunting

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.