CyberRota Analysis
AI-GeneratedIn Akaunting versions up to 3.1.21, low-privileged authenticated users can exploit a flaw in the `UpdateUser` job to elevate their privileges by assigning themselves the admin role, thereby gaining full administrative access. This vulnerability arises from inadequate authorization checks during the role assignment process, allowing users with minimal permissions to manipulate their own roles. Organizations using affected versions should prioritize patching this vulnerability to prevent unauthorized access and potential system compromise.
Original NVD Description
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue.