# CVE-2026-105325: Accounting privilege escalation via missing permission check

Source: https://junglewise.ai/threats/cve-2026-105325-missing-check-for-accounting-update-accounting-create-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-105325 · Severity: info · Published 2026-11-05

A flaw in accounting software allows users with read-only permissions to create and modify payment records they should not be able to access. This breaks access control intended to prevent unauthorized financial transactions and record tampering.

Technologies: [<UNKNOWN>](https://junglewise.ai/threats/technologies/x-unknown).

## Quick answers

**Is CVE-2026-105325 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105325 being exploited in the wild.

**How severe is CVE-2026-105325?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** <UNKNOWN> before 24.09.08.

**Is there a fix for CVE-2026-105325?** Yes: fixed in 24.09.08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105325 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-105325?** Check whether you run <UNKNOWN> at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 24.09.08

## Technical details

A missing authorization check in the accounting module fails to enforce ACCOUNTING_UPDATE and ACCOUNTING_CREATE permissions before allowing operations on PaymentApplication records. An attacker with only ACCOUNTING_VIEW permission can exploit this to bypass intended access controls and perform unauthorized create and update operations on accounting data.

## Affected products

- <UNKNOWN> before 24.09.08

## Timeline

- 2026-11-05: disclosed

## References

- [https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz](https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz)

## Related threats

- [System component denial of service vulnerability](https://junglewise.ai/threats/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under)
- [Hessian remoting authentication bypass with non-root context path](https://junglewise.ai/threats/cve-2026-97874-when-hessian-remoting-is-configured-with-basic-authentication-the)
- [Embedded server weak session ID generation](https://junglewise.ai/threats/cve-2026-111259-the-embedded-server-generates-http-session-identifiers-with-a)
- [Web application request routing security constraint bypass](https://junglewise.ai/threats/cve-2026-111258-the-optional-request-routing-feature-forwards-requests-to-their)
- [SSH administration service authentication bypass](https://junglewise.ai/threats/cve-2026-111239-the-optional-ssh-administration-service-grants-full-access-to)