Akaunting’s shared download endpoint (app/Http/Controllers/Common/Uploads.php::download()) allows an authenticated portal customer to download any media record by specifying an ID. The handler retrieves the Media record using the supplied ID without confirming that the media belongs to the requesting user’s company. This deficiency permits an attacker to obtain confidential files from other companies without additional privileges, resulting in a data confidentiality breach. The flaw is an Insecure Direct Object Reference (CWE-639).

The vulnerability affects the Akaunting application, as identified by the CNA vendor/service named akaunting:akaunting. No specific version ranges are provided in the CNA data, so any installation of Akaunting that includes the vulnerable download route is at risk until the fix is applied.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. An attacker only needs to be an authenticated portal user; no elevated privileges or remote code execution are required. The attacker can simply enumerate media IDs or guess them to download sensitive files, making the exploit straightforward though limited to authenticated sessions. Because the flaw exists in a public-facing route, the risk to customer data is tangible but mitigated by the requirement for authentication.