CVE-2026-5568

CVE-2026-5568 is a cross-site scripting (XSS) vulnerability affecting Akaunting versions up to 3.1.21, specifically in the Invoice/Billing component where the notes argument fails to properly sanitize user input. This remotely exploitable flaw allows authenticated attackers to inject malicious scripts that could compromise user sessions or steal sensitive billing information. The vulnerability carries a CVSS score of 3.5 (Low severity) with a network-based attack vector requiring low complexity and authenticated user privileges. The attack requires user interaction to succeed and is limited to information integrity impact with no confidentiality or availability implications. The EPSS score of 0.0001 indicates minimal current exploitation probability relative to other CVEs. The vulnerability has been publicly disclosed with exploit code available, though it is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation indicators. The vendor was notified early but provided no response or patch, leaving users reliant on workarounds or system isolation until updates become available. Community adoption remains limited given the low CVSS rating and authentication requirement.