CVE-2026-118597

Description

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 7.2CVSS 4.0, Highfrom the CNA (Fluid Attacks)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

What to do

• Use a JavaScript-safe serializer such as Laravel Js::from() or a framework data binding for the custom payment-term value; validate it as a bounded integer when it represents a number of days; apply the vendor-fixed release once one is published.CNA solution statement
• Use only predefined payment-term options, replace existing custom values, and restrict invoice-settings update access to trusted users until a vendor fix is available. Treat this as temporary mitigation rather than a fix.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-592 Stored XSS (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 27 Oct 2026 Vulnerability discovered
2. 28 Oct 2026 Vendor contacted
3. 12 Nov 2026 Public disclosure
4. 12 Nov 2026 Published

Weakness

• CWE-79

References

• fluidattacks.comthird-party-advisory
• github.comproduct
• github.comtechnical-description
• github.comtechnical-description
• github.comtechnical-description