CVE-2026-8193 is a server-side request forgery vulnerability affecting Akaunting 3.1.21. The issue arises from improper handling of the config/dompdf.php file in the Invoice PDF Rendering component, allowing an attacker with low privileges to manipulate server requests remotely. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not issued a patch or provided remediation details. The CVSS 4.0 score is 5.3, indicating medium severity.

Successful exploitation of this SSRF vulnerability could allow an attacker to induce the server to make unauthorized requests, potentially accessing internal resources or services not otherwise reachable. However, the impact is limited by the requirement of low privileges and the vulnerability's medium severity rating. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official Akaunting channels for updates. Until a patch is available, consider restricting network access from the affected component to sensitive internal resources as a temporary mitigation.