TI-2021-14924 Aliases CVE-2021-36804 GHSA-246r-r2wf-frhx

Akaunting Password Reset Relay

LOW 37CWE-640Published 2021-08-04 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-640.

Summary

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.

Why it matters now

EPSS 0.00957 61st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed akaunting/akaunting (Packagist): 2.1.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Akaunting	Akaunting	2.1.12 – 2.1.12	—	No fix listed	CNA
—	akaunting/akaunting (Packagist)	before 2.1.13	2.1.13	Patch available	GHSA-246r-r2wf-frhx

Akaunting VendorAkaunting Affected 2.1.12 – 2.1.12 Fixed in — No fix listed CNA
akaunting/akaunting (Packagist) Vendor— Affected before 2.1.13 Fixed in 2.1.13 Patch available GHSA-246r-r2wf-frhx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:akaunting:akaunting::::::::	before 2.1.13	Vulnerable	Akaunting

cpe:2.3:a:akaunting:akaunting:*:*:*:*:*:*:*:* Versions before 2.1.13 Vulnerable ·Akaunting

Remediation

Fix · GHSA-246r-r2wf-frhx akaunting/akaunting (Packagist) Fixed in 2.1.13 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-36804
2026-10-03 Alias added: GHSA-246r-r2wf-frhx

References

Exploit 1

https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/

Patch 1

https://github.com/laravel/laravel/pull/5477

Advisory 2

Other 3

TI-2024-15147 An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. CVSS 3.1CRITICAL 9.8
TI-2025-35028 Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting… CVSS 3.1MEDIUM 6.5
TI-2025-35027 An issue in the component /settings/localisation of Akaunting v3.1.18 allows… CVSS 3.1MEDIUM 6.5
TI-2021-14920 Akaunting OS Command Injection in 'Money.php' CVSS 3.1CRITICAL 9.1
TI-2020-14331 Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. CVSS 3.1HIGH 8.8
TI-2021-14921 Akaunting Authentication Bypass in Company Selection CVSS 3.1HIGH 8.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences