CyberRota Analysis
AI-GeneratedAkaunting's shared download functionality is vulnerable, allowing authenticated users to access and download files uploaded by other companies due to a lack of ownership verification. This could lead to unauthorized data exposure, impacting the confidentiality of sensitive information. Organizations using Akaunting should prioritize this vulnerability to protect against potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.