Akaunting 3.1.21 allows an authenticated user with the right to create or modify records to store arbitrary HTML or JavaScript in a record’s name. When that record is later deleted, the delete confirmation modal displays the stored data, causing the browser to execute the script in the context of the current user. The result is an authenticated local XSS that can steal session cookies, perform phishing attacks, or execute other malicious actions within the affected user’s session. It does not provide remote code execution on the server side but enables attackers to compromise confidentiality and integrity for users who trigger the delete flow.

The vulnerability exists in Akaunting 3.1.21 running on Linux, macOS, and Windows platforms. No version upgrades or patches are listed in the current data; the affected product is the entire Akaunting application at that specific release.

The CVSS score of 4.8 indicates a moderate severity level. Because the exploit requires authentication and specific permissions, the attack surface is limited to users who can modify records. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first gain access with appropriate privileges, then create or alter a record to inject malicious code. The stored script is replayed each time the delete confirmation is invoked by any user with permission to view the record, extending the vulnerability’s impact across multiple users until patched.