Vulnerability record/PUBLISHED/Published Nov 14, 2026 10:45:18 UTC
CVE-2026-129248
A weakness has been identified in Akaunting up to 3.3.0. The affected element is the function calculation_to_quantity of the file helpers.php of the component Invoice Item Validation. Executing a manipulation of the argument quantity can lead to numeric range comparison without minimum check. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Base score5.3/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityLowVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
Exploit maturityNot definedE
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:XCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulDB
Last updatedNov 14, 2026 10:45:18 UTC
PublishedNov 14, 2026 10:45:18 UTC
ReservedNov 13, 2026 19:29:49 UTC
Credits
- Raygun (VulDB User)
- VulDB CNA Team