Akaunting’s shared download route, located at uploads/{id}/download and protected only by generic authentication middleware, retrieves a media record solely by the supplied ID and does not verify that the record belongs to the requesting portal customer’s company. An authenticated customer can therefore specify any media ID, causing the server to serve files from other companies. This leads directly to a confidentiality breach, as private company documents can be exposed without any additional privileges, and is an example of an Insecure Direct Object Reference (CWE‑639).

The vulnerability impacts the Akaunting application, as identified by the CNA. No specific version ranges are provided, meaning any installation that includes the download endpoint is susceptible until a fix is applied.

With a CVSS score of 6.5 the flaw is moderate in severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker must simply be an authenticated portal user; no elevated rights or remote code execution are required. Once authenticated, the attacker can enumerate or guess media IDs to download files belonging to other companies, making the exploit straightforward but confined to authenticated sessions.