Akaunting versions up to 3.1.21 let any low‑privileged authenticated user modify their own account to assign themselves the admin role ID when using the UpdateUser job. The job calls roles()->sync() unconditionally without verifying the caller’s authorization, allowing privilege escalation. The flaw, identified as CWE-269 and CWE-862, results in an access‑control weakness, involving both an improper authorization check and a data‑level privilege elevation. With the newly granted administrator rights, the attacker can perform all actions available to an administrator, including modifying data, configuration, and other users’ permissions. Note that the API endpoints are properly permission‑gated and are not affected by this issue. The vulnerability is remedied in v3.2.0, commit 80ef6d3b154a.

The vulnerability affects Akaunting, version 3.1.21 and earlier. Users of these releases that have the update‑auth‑profile permission are at risk.

The flaw is not listed in CISA’s KEV catalog and the EPSS score, which indicates a very low but nonzero exploitation probability, is < 1%. The CVSS score of 8.1 categorizes this as high severity. However, because it requires only low‑privileged authentication, the attack surface is significant for any compromised internal account. Exploitation is straightforward: a user simply edits their own profile to set the administrator role ID. Attacker reach is limited to users who can log into the system, so the risk is high within the affected tenant but does not enable remote code execution on the hosting environment. The vulnerability has been remediated in v3.2.0.