# CVE-2026-11942: Akaunting stored XSS in delete confirmation flow

Source: https://junglewise.ai/threats/cve-2026-11942-akaunting-stored-xss-in-delete-confirmation-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-11942 · Severity: info · CVSS 4.8 · Published 2026-06-22

Akaunting, an open-source online accounting software, is vulnerable to a security flaw where malicious code can be hidden within record names. An attacker with administrative permissions can inject scripts that execute when other users interact with the delete confirmation screen. This could allow an attacker to perform unauthorized actions or steal session information from other administrative users.

Technologies: [Akaunting](https://junglewise.ai/threats/technologies/akaunting). Vendors: [Akaunting](https://junglewise.ai/threats/vendors/akaunting).

## Quick answers

**Is CVE-2026-11942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11942 being exploited in the wild.

**How severe is CVE-2026-11942?** Informational severity, with a CVSS score of 4.8, published 22 June 2026.

**Which products and versions are affected?** Akaunting 3.1.21.

**Is there a fix for CVE-2026-11942?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11942 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11942?** Check whether you run Akaunting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Akaunting version 3.1.21. The flaw is located in the reusable delete confirmation flow, where the application fails to properly sanitize record names (such as 'Items') before displaying them in a modal. An authenticated attacker with high privileges (permissions to create or modify records) can inject malicious HTML or JavaScript into a record name. The payload is executed in the context of any user who attempts to delete the affected record and views the confirmation prompt. This vulnerability is tracked as CWE-79.

## Affected products

- Akaunting Akaunting 3.1.21

## Timeline

- 2026-06-22: disclosed
- 2026-06-22: advisory

## References

- [https://fluidattacks.com/es/advisories/human](https://fluidattacks.com/es/advisories/human)
- [https://github.com/akaunting/akaunting](https://github.com/akaunting/akaunting)

## Related threats

- [Akaunting stored cross-site scripting in invoice import](https://junglewise.ai/threats/cve-2026-119275-akaunting-3-3-0-contains-a-stored-cross-site-scripting)
- [Akaunting stored cross-site scripting in invoice status field](https://junglewise.ai/threats/cve-2026-118855-akaunting-3-3-0-contains-a-stored-cross-site-scripting)
- [Akaunting stored XSS in custom invoice payment terms](https://junglewise.ai/threats/cve-2026-118597-akaunting-3-3-0-contains-a-stored-cross-site-scripting)
- [Akaunting stored cross-site scripting in XLSX item import](https://junglewise.ai/threats/cve-2026-118368-akaunting-3-3-0-contains-a-stored-cross-site-scripting)
- [Akaunting OS command injection in module installation](https://junglewise.ai/threats/cve-2022-51019-akaunting-before-2-1-31-contains-an-os-command-injection)