Akaunting accounting software 3.1.21 includes an authenticated stored cross-site scripting flaw in the report management workflow. A user who can create or update reports can store arbitrary HTML or JavaScript in the report description field, which is later rendered by the web interface. When another authorized user views that report, the malicious script executes in the victim’s browser, allowing the attacker to hijack the user’s session, steal credentials, or alter page content. The weakness is a classic input‑validation flaw, identified as CWE‑79.

The flaw affects all installations of Akaunting version 3.1.21 running on Linux, macOS, or Windows. Only accounts with permissions to create or update reports are required to exploit the issue.

The CVSS score is 4.8, indicating a moderate severity. EPSS is not reported, and the vulnerability is not present in the CISA KEV catalog. The attack vector requires an authenticated user with report‑management privileges; therefore, the exploit is limited to insiders or compromised accounts. However, once an attacker can create or modify a report, any other user who views that report will be exposed to the injected code. Organizations using Akaunting 3.1.21 should consider the risk moderate but non‑negligible for internal threat models.