CVE-2026-16772 [HIGH] – In Akaunting versions sync()` call without verifying whether the caller is authorized to m

In Akaunting versions sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue.