CVE-2026-80210
FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.
| CWE | CWE-352 |
| Vendor | frontaccounting |
| Product | frontaccounting |
| Published | Aug 27, 2026 |
| Last Updated | Aug 27, 2026 |
Get instant alerts for frontaccounting frontaccounting
Be the first to know when new medium vulnerabilities affecting frontaccounting frontaccounting are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N