CVE-2021-36804 json
Akaunting Password Reset Relay
published 2021-08-04 5 y ago modified 2026-06-17 4 mo ago also GHSA-246r-r2wf-frhx , EUVD-2021-1945
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.
Patch / fix
- packagist akaunting/akaunting 2.1.13
- akaunting akaunting 2.1.13
- github.com/laravel/laravel#5477 pull request
Exploit prediction
0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- rapid7.com https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | akaunting/akaunting | <2.1.13 |
2.1.13 |
Affected products
- Akaunting Akaunting
Classification
- Weakness
-
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
References
-
github.com
/laravel/laravel/pull/5477
web, issue-tracking, patch, third-party-advisory
-
rapid7.com
/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
exploit, third-party-advisory
-
laravel-enlightn.com
/docs/security/host-injection-analyzer.html
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-36804
advisory
-
github.com
/laravel/laravel
package
-
github.com
/laravel/laravel/blob/75a7dba9c44ce3555cc57dd1826467839fd9774f/CHANGELOG.md#v844-2020-12-01
web
-
rapid7.com
/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed
web
Sources
- CVE List CVE-2021-36804
- GitHub Advisory GHSA-246r-r2wf-frhx
- NVD CVE-2021-36804
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.