Descripción
Akaunting-s shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer-s own company, allowing any authenticated portal customer to download any other company-s uploaded files by guessing or enumerating media IDs.
CVSS 6.5EPSS 0.201%Riesgo 0.66
Ver fuente- Publicación
- 2026-08-05 11:16:28
- Última modificación
- 2026-08-10 12:17:27
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N