https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:08:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349647 EUVD-2026-349647 https://cve.radiocsirt.org/vuln/euvd-2026-349647 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71251 <p>Akaunting&#39;s shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer&#39;s own company, allowing any authenticated portal customer to download any other company&#39;s uploaded files by guessing or enumerating media IDs.</p> <p>Akaunting&#39;s shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer&#39;s own company, allowing any authenticated portal customer to download any other company&#39;s uploaded files by guessing or enumerating media IDs.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71251 https://cve.radiocsirt.org/vuln/ghsa-h26w-wq3x-9p76 <p>Akaunting&#39;s shared download route (app/Http/Controllers/Common/Uploads.php::download(), reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer&#39;s own company, allowing any authenticated portal customer to download any other company&#39;s uploaded files by guessing or enumerating media IDs. Fixed in commit 80ef6d3 (2026-07-12), which added an explicit ownership check comparing the media&#39;s parent record contact_id against the requesting user&#39;s own contact.</p> <p>Akaunting&#39;s shared download route (app/Http/Controllers/Common/Uploads.php::download(), reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer&#39;s own company, allowing any authenticated portal customer to download any other company&#39;s uploaded files by guessing or enumerating media IDs. Fixed in commit 80ef6d3 (2026-07-12), which added an explicit ownership check comparing the media&#39;s parent record contact_id against the requesting user&#39;s own contact.</p> https://cve.radiocsirt.org/vuln/ghsa-h26w-wq3x-9p76